CVE-2026-70426 describes a vulnerability in the Jenkins Remoting component where the JEP-200 deserialization filter is not applied to classes resolved through a fallback path. This flaw affects Remoting versions 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, which are included in Jenkins 2.575 and earlier and LTS 2.568.1 and earlier. The vulnerability allows agent processes, code running on agents, or attackers with Agent/Connect permission to bypass the deserialization filter, potentially enabling execution of unauthorized code or other impacts related to deserialization flaws on the Jenkins core classpath.

The vulnerability allows bypassing the JEP-200 deserialization filter, which is designed to restrict unsafe classes during deserialization. This could enable attackers with Agent/Connect permission or compromised agent processes to execute or load unauthorized classes on the Jenkins core classpath, potentially leading to unauthorized code execution or other security impacts within the Jenkins environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Agent/Connect permissions to trusted users and agents only to reduce risk. Monitor Jenkins updates for patches addressing this vulnerability.