CVE-2026-53435: Vulnerability in Jenkins Project Jenkins
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
AI Analysis
Technical Summary
The vulnerability in Jenkins 2.567 and earlier (including LTS 2.555.2 and earlier) involves unsafe deserialization of attacker-controlled data from the config.xml submission. This flaw allows attackers to manipulate Jenkins to handle HTTP requests as any user, potentially leading to arbitrary code execution through the Script Console or unauthorized file access on the Jenkins controller. No CVSS score or official remediation level is provided in the available data.
Potential Impact
Exploitation of this vulnerability can lead to full impersonation of any Jenkins user, unauthorized HTTP request execution on their behalf, arbitrary code execution via the Script Console, and unauthorized reading of files on the Jenkins controller. This represents a critical compromise of confidentiality, integrity, and availability of the Jenkins environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Jenkins config.xml submissions to trusted users only and monitor for suspicious activity related to config changes. Avoid exposing Jenkins to untrusted networks or users.
CVE-2026-53435: Vulnerability in Jenkins Project Jenkins
Description
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/jenkinsci/jenkinsWeaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Jenkins 2.567 and earlier (including LTS 2.555.2 and earlier) involves unsafe deserialization of attacker-controlled data from the config.xml submission. This flaw allows attackers to manipulate Jenkins to handle HTTP requests as any user, potentially leading to arbitrary code execution through the Script Console or unauthorized file access on the Jenkins controller. No CVSS score or official remediation level is provided in the available data.
Potential Impact
Exploitation of this vulnerability can lead to full impersonation of any Jenkins user, unauthorized HTTP request execution on their behalf, arbitrary code execution via the Script Console, and unauthorized reading of files on the Jenkins controller. This represents a critical compromise of confidentiality, integrity, and availability of the Jenkins environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Jenkins config.xml submissions to trusted users only and monitor for suspicious activity related to config changes. Avoid exposing Jenkins to untrusted networks or users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jenkins
- Date Reserved
- 2026-06-09T14:26:44.788Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2967b2c9170919df1fd8fd
Added to database: 6/10/2026, 1:33:38 PM
Last enriched: 6/10/2026, 1:49:55 PM
Last updated: 6/10/2026, 4:12:28 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.