CVE-2026-53435: Jenkins Core Arbitrary Type Deserialization Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-53435: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a wa... Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.555.3
>= 2.556, < 2.568
Fixed in 2.555.3 or 2.568, depending on the release line you run. How to fix ↓
Also tracked for
- jenkins · Bitnami
The same CVE-2026-53435 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server widely used for continuous integration and continuous delivery (CI/CD). It allows developers to automate the building, testing, and deployment of software. Jenkins is highly extensible, with a rich ecosystem of plugins that enhance its functionality. However, certain vulnerabilities can arise from its configuration management, particularly when handling user-defined configurations.
Vulnerability Detail
In Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier, an arbitrary type deserialization vulnerability exists. Attackers can exploit this flaw by submitting a malicious 'config.xml' file, which Jenkins will deserialize. This can lead to unauthorized user impersonation and the ability to send HTTP requests on behalf of any user, including executing arbitrary code through the Script Console or reading sensitive files from the Jenkins controller. The vulnerability is classified under CWE-502, indicating a risk associated with deserialization of untrusted data.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.555.32.555.3 -
>= 2.556, < 2.5682.568
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins instance and validate the 'config.xml' submissions to ensure they do not contain malicious payloads. Additionally, consider disabling any plugins that may allow for arbitrary code execution until the update is applied.
Conclusion
The CVE-2026-53435 vulnerability poses a significant risk to Jenkins users, allowing for remote code execution and user impersonation through malicious configuration files. It is essential to update to the latest patched versions to mitigate this risk effectively.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
CVE-2026-53435 is a vulnerability in Jenkins that allows for arbitrary type deserialization from attacker-controlled 'config.xml', potentially leading to remote code execution.
If you are running Jenkins version 2.567 or earlier, or LTS 2.555.2 or earlier, your instance is vulnerable. You can also use Vulert to check your application for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized user impersonation, execution of arbitrary code, and exposure of sensitive files.
You can update Jenkins to version 2.555.3 or later, or to version 2.568 or later. Follow the update instructions specific to your installation method.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the pom.xml file. You can check if your application is affected by visiting the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
