Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:29.713Z",
  "pubdate": "2026-09-02T16:17:29.713Z",
  "executiveSummary": "This vulnerability involves an insecure deserialization flaw within Jenkins that permits the manipulation of transient fields during configuration updates.\nThe vulnerability allows attackers who possess the ability to submit configuration updates to specify values for fields that would otherwise be excluded from the serialization process.\nThe affected systems include Jenkins 2.579 and earlier, as well as Jenkins LTS 2.568.2 and earlier.\nThe primary risk stems from the potential for arbitrary code execution or unauthorized state modification, depending on how the affected transient fields are utilized by the application logic post-deserialization.\nExploitation requires the attacker to have existing, albeit limited, privileges sufficient to perform configuration updates within the Jenkins environment, effectively escalating their ability to influence server-side object state beyond intended design constraints.\nThe integrity and security posture of the Jenkins instance are compromised when these transient fields are improperly handled, potentially leading to unauthorized system manipulation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of transient fields during the deserialization process in Jenkins core components. In standard Java serialization, the transient modifier is intended to signify that a field should not be serialized when the object is persisted. However, the affected Jenkins versions fail to enforce the exclusion of these fields during deserialization when configuration data is processed.\nWhen a user with configuration update privileges submits a payload, the application deserializes the input into memory. Because the system fails to prevent the population of fields marked as transient, an attacker can supply malicious or arbitrary data into these fields that would typically remain unpopulated or initialized to default values during the reconstruction of the object.\nThe attack flow begins with the attacker accessing a configuration update endpoint. The attacker constructs a serialized payload or a configuration update request designed to target specific transient fields within a Jenkins object model. By forcing the application to deserialize this input, the attacker populates transient fields with controlled data.\nOnce the object is successfully reconstructed with the manipulated values, subsequent operations within Jenkins that reference these fields will utilize the attacker-supplied data. The impact is highly dependent on the function and usage of the targeted transient fields; if these fields are used in sensitive downstream operations—such as file path construction, command execution, or authorization logic—it may facilitate remote code execution (RCE) or bypass security checks.\nThis vulnerability essentially bypasses the developer's intent regarding the object's persistence state, allowing for the injection of data into components that rely on the immutability or non-persistence of certain internal states. The lack of validation regarding the structure and content of the deserialized configuration allows the attacker to influence the application's runtime state significantly.\nThe vulnerability is limited to those with authorization to perform configuration updates, though the scope of the exploit depends on which Jenkins plugins or core functions rely on these improperly deserialized objects. As no effective mechanism exists within the affected versions to sanitize the transient fields during the deserialization of configuration updates, the attack surface remains exposed to any user capable of modifying Jenkins configurations."
}