CVE-2026-53435

A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted config.xml file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is th...

VulnCheck KEV: CVE-2026-53435

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to...

BIT-JENKINS-2026-53441

Jenkins 2.483 through 2.567 both inclusive, LTS 2.492.1 through 2.555.2 both inclusive does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers...

CVE-2026-53436 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-53438 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-3RQH-HCH3-JHPC vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-MW82-XCG6-GX79 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-53439 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-53437 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-M6WV-WH8G-64XC vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-G28P-6MCC-V4RV vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-92M7-4FPW-2WXM vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-463R-5M89-4XFR vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-53442 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-53440 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-G2XQ-2V27-4RH3 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-53435 vulnerabilities

Vulnerabilities for packages: jenkins...

Exploit for Deserialization of Untrusted Data in Jenkins

CVE-2026-53435 — Jenkins Deserialization → Arbitrary File Read...

BIT-JENKINS-2026-53442

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to t...

BIT-JENKINS-2026-53440

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain...