BIT-JENKINS-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

PT-2026-73342

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-70426

A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in th...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

Agent-to-controller deserialization filter bypass

Jenkins uses the https://github.com/jenkinsci/remotingRemoting library typically agent.jar or remoting.jar for communication between the controller and agents via serialized Java objects. To protect against deserialization vulnerabilities, Jenkins enforces the https://jenkins.io/jep/200JEP-200...

PT-2026-68261

Name of the Vulnerable Software and Affected Versions Remoting versions prior to 3384.v60d89463d9e0 excluding version 3355.3357.v931d3c992987 Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description The JEP-200 class filter is not applied to classes resolved via a fallbac...

CVE-2026-70426: Deserialization of Untrusted Data

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

Arbitrary File Read

org.jenkins-ci.main, jenkins-core and org.jenkins-ci.main, remoting are vulnerable to Arbitrary File Read. The vulnerability is caused due to a missing validation on the file paths that are invoked on the controller by the agent while retrieving files using API ClassLoaderProxyfetchJar. This allo...

Unauthorized users could access agent logs

Users with Overall/Read permission were able to access the URL serving agent logs on the UI due to a lack of permission checks. Access to the affected URL is now limited to users with the correct Agent/Connect permission...

Unauthorized users could initiate and abort agent launches

The URL that initiates agent launches on the Jenkins controller did not perform a permission check, allowing users with Overall/Read permission to initiate agent launches. Doing so canceled all ongoing launches for the specified agent, so this allowed attackers to prevent an agent from launching...