Database/Control plane, storage & DevOps
Jenkins: XStream deserialization filter not applied to resolves-to classes
Impact
Jenkins' XStream deserialization filter is the control that keeps attacker-supplied XML from instantiating dangerous classes. Classes named by the resolves-to attribute bypass it, reopening the gadget-chain path the filter exists to close. The practical result is code execution in the controller JVM for a user who can get XML deserialized - which on a GPU cluster means the box holding registry credentials, kubeconfigs and signing keys for the fleet. Scored 8.8 by the CNA.
Who can reach it
Network, authenticated with low privilege (the CNA vector states PR:L); any path that feeds XStream XML to the controller.
What to do
Upgrade to the fixed weekly and LTS releases from the 2026-10-28 advisory and restart the controller; this record does not carry the fixed version numbers. Patch and daemon restart only - no agent or GPU node downtime.
References
Related entries
- Jenkins: unvalidated agent name lets a read-only user load and overwrite arbitrary config.xml on the controllerCVE-2026-117616 · Jenkins controller (agent-by-name HTTP endpoint)High
- Jenkins: low-privilege user can seed Manage Old Data warnings that overwrite user accounts including passwordsCVE-2026-117620 · Jenkins controller ("Manage Old Data" migration feature)High
- Jenkins: root element check bypass allows nesting types meant to live only in top-level config filesCVE-2026-117624 · Jenkins controller (XStream root element check for top-level configuration types)High
- MinIO: unsigned x-amz-* headers accepted in SigV4, escalating a presigned PUT into a cross-bucket readCVE-2026-122267 · MinIO (S3 Signature V4 verification)High
- Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High
- Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.