CVE-2026-53435: Jenkins Arbitrary Deserialization Vulnerability
Summary
CVE-2026-53435: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a wa... Affects jenkins versions < 2.568.0. Fixed in 2.568.0. How to fix ↓
Also tracked for
- org.jenkins-ci.main:jenkins-core · Maven
The same CVE-2026-53435 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server widely used for continuous integration and continuous delivery (CI/CD). It allows developers to automate various stages of software development, including building, testing, and deploying applications. Jenkins is highly extensible, with a rich ecosystem of plugins that enhance its functionality. However, certain vulnerabilities can arise due to its complex architecture, particularly related to deserialization of user-controlled data.
Vulnerability Detail
In Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier, there exists a critical vulnerability that allows attackers to exploit deserialization of arbitrary types from a maliciously crafted 'config.xml' submission. This vulnerability can lead to unauthorized impersonation of users, enabling attackers to send HTTP requests on behalf of any user. The implications are severe, as it can allow attackers to execute arbitrary code via the Script Console or access sensitive files from the Jenkins controller.
How To Fix
Minimum fixed version
2.568.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Jenkins server to trusted users only, thereby minimizing the risk of exploitation until you can apply the patch. Additionally, consider disabling any plugins that may be vulnerable until they are updated.
Conclusion
CVE-2026-53435 represents a significant security risk for Jenkins users, allowing attackers to exploit deserialization vulnerabilities. It is crucial to update to the patched version to safeguard your Jenkins environment. Regular monitoring and prompt updates are essential to maintain security.
See every vulnerability recorded for jenkins →
FAQ
CVE-2026-53435 is a vulnerability in Jenkins that allows attackers to exploit deserialization of arbitrary types, potentially leading to unauthorized actions on behalf of users.
If you are using Jenkins version 2.567 or earlier, including LTS 2.555.2 or earlier, your installation is vulnerable. You can check your version in the Jenkins dashboard.
The risks include unauthorized user impersonation, execution of arbitrary code, and access to sensitive files, which can compromise the security of your Jenkins environment.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
If an immediate update is not possible, restrict access to your Jenkins instance and disable any vulnerable plugins as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for jenkins.
