Description

Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:31.640Z",
  "pubdate": "2026-09-02T16:17:31.640Z",
  "executiveSummary": "The Jenkins Performance Plugin, in versions 1015.v09ca_52b_3370e and earlier, is susceptible to a critical deserialization vulnerability.\nThis vulnerability is categorized as an insecure deserialization issue, allowing for Remote Code Execution (RCE) on the Jenkins controller.\nThe flaw stems from the plugin's failure to implement adequate input validation or type filtering when deserializing cached performance report data stored within the build directory.\nSuccessful exploitation grants an authenticated attacker with 'Item/Configure' permissions the capability to execute arbitrary code within the context of the Jenkins controller process.\nThe risk is severe as it enables full system compromise, unauthorized data access, and potential lateral movement within the Jenkins environment.\nExploitation requires the attacker to have the ability to configure Jenkins jobs, allowing them to manipulate the performance reports processed by the plugin.",
  "technicalDetails": "The vulnerability resides in the Jenkins Performance Plugin's mechanism for handling cached performance reports. When a build is executed, the plugin stores serialized performance report data directly on the Jenkins controller's file system within the specific build directory.\nUpon subsequent access or processing of these reports, the plugin performs deserialization of the cached data using Java's native object input streams without a blocklist or whitelist mechanism to constrain the classes permitted for instantiation.\nBecause the plugin fails to enforce deserialization filtering, an attacker with 'Item/Configure' access can influence the contents of these cached files. By crafting a malicious serialized object—often leveraging 'gadget chains' present in the Jenkins classpath (e.g., standard library classes or common library dependencies)—the attacker can trigger arbitrary code execution upon the invocation of the deserialization routine.\nThe attack flow proceeds as follows: First, the attacker uses their 'Item/Configure' privileges to modify a Jenkins project configuration or supply a malicious payload that the Performance Plugin will eventually process as a performance report. Second, the attacker causes the Jenkins controller to write this malicious serialized object to the build directory. Third, the attacker triggers an action that forces the Jenkins Performance Plugin to read and deserialize the manipulated file.\nDuring the deserialization process, the JVM reconstructs the malicious object, which may contain an invocation sequence designed to instantiate arbitrary classes or execute system commands upon the completion of the readObject() call or subsequent method calls on the deserialized object.\nThis vulnerability is particularly dangerous because the Jenkins controller typically operates with high-level system permissions. Successful exploitation results in the execution of arbitrary commands with the identity of the user running the Jenkins controller process. This bypasses typical access controls within Jenkins, as the code executes outside the sandbox environment provided by the Jenkins security layer. The impact includes, but is not limited to, the exfiltration of credentials stored in the Jenkins credentials store, manipulation of build artifacts, and persistent control over the host server."
}