Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T16:17:29.313Z",
  "pubdate": "2026-09-02T16:17:29.313Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within the Jenkins core during the deserialization of XML-based objects. The issue allows unauthorized creation of user objects by manipulating nested field values in crafted XML payloads. Affected systems include Jenkins versions 2.579 and earlier, and LTS versions 2.568.2 and earlier.\nThe vulnerability type is categorized as an improper deserialization of untrusted input. The impact is significant as it permits an attacker to perform unauthorized actions by instantiating arbitrary user objects within the application context. This could potentially lead to privilege escalation or the manipulation of user-based security configurations. Exploitation requires the attacker to possess 'Overall/Read' permissions, which is a common access level for authenticated users in many Jenkins environments. By submitting a specially crafted XML request, an attacker can bypass standard object instantiation constraints, creating unintended user entries that could be leveraged for further malicious activities. The risk is elevated due to the ease of crafting XML payloads and the potential for persistent impact on the Jenkins security domain.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation of XML data during the deserialization process in Jenkins core. Jenkins utilizes XStream for processing XML representations of objects; however, when handling nested field values, the system fails to adequately restrict the types of objects that can be instantiated or the context in which they are created.\nIn the affected versions, Jenkins allows user objects to be defined or referenced as nested elements within serialized XML streams. An attacker with 'Overall/Read' access can exploit this by submitting a crafted XML payload to an endpoint that processes XML-based object deserialization. By embedding a user object definition into a field that the application expects to deserialize, the attacker tricks the XML parser into instantiating a user object within the Jenkins security realm.\nThe exploitation flow proceeds as follows: First, the attacker identifies an API endpoint or a feature within Jenkins that accepts XML input for object state restoration or configuration. Second, the attacker constructs a payload containing a serialized user object, carefully nesting it within the expected XML structure to bypass validation filters that might be applied to top-level objects but are overlooked for nested components. Third, the crafted payload is transmitted to the server via an authorized request. Upon receipt, the Jenkins XML parser processes the input, and the XStream configuration fails to prevent the creation of the user object during the recursive deserialization of the nested structure.\nThe vulnerable component is the Jenkins core XML deserialization logic. This flaw is independent of specific plugins, as it resides within the foundational mechanisms used to convert stored or transmitted XML data back into live Java objects. Because the application logic does not sufficiently enforce an allow-list or perform rigorous type-checking during the nested deserialization phase, the object instantiation succeeds. The post-exploitation impact includes the creation of persistent, unauthorized user records which may be utilized to manipulate internal permissions, access user-specific data, or serve as a vector for further unauthorized system modifications, depending on the subsequent application behavior toward these injected user objects."
}