CVE-2018-1000861: Deserialization of Untrusted Data in Jenkins
Summary
CVE-2018-1000861: Deserialization of Untrusted Data in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.138.4
>= 2.140, < 2.154
Fixed in 2.138.4 or 2.154, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000861, exists in the Stapler web framework used by Jenkins. More specifically, the issue resides in the 'MetaClass.java' file within the 'stapler/core/src/main/java/org/kohsuke/stapler' directory. Attackers can exploit this vulnerability by accessing crafted URLs that were not intended to be invoked, allowing them to invoke certain methods on Java objects. This can lead to arbitrary code execution and potential compromise of the Jenkins server. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.138.42.138.4 -
>= 2.140, < 2.1542.154
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is possible to disable the Stapler web framework by setting the system property 'stapler.disable' to 'true'. However, this may impact the functionality of Jenkins and is not a recommended long-term solution. It is strongly advised to apply the official fix by upgrading to the patched versions.
Conclusion
In conclusion, the CVE-2018-1000861 vulnerability in Jenkins exposes the server to potential code execution through unauthorized method invocations. It is crucial to upgrade to the fixed versions to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery processes. It helps developers build, test, and deploy their software projects efficiently.
The vulnerable package is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.
The vulnerability can be exploited by accessing crafted URLs that were not intended to be invoked. This allows attackers to invoke certain methods on Java objects, potentially leading to arbitrary code execution.
The vulnerability has a CVSS score of 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade Jenkins to the fixed versions mentioned earlier. This will patch the vulnerability and prevent unauthorized method invocations.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
