PT-2026-88163

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84646

In Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), a vulnerability exists where user objects can be embedded as nested field values within other deserialized XML objects . This flaw allows an attacker with Overall/Read permissions to create new user objects by submitting crafted XM...

PT-2026-84769

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...