Jenkins: symlink following during item rename discloses arbitrary controller files

Impact

Renaming an item copies its directory, and Jenkins followed symbolic links while doing so. A user who can create and configure items can plant a link and have the controller copy any file its process can read into a location the user can fetch. On a CI controller that means secrets files, credential stores and cluster kubeconfigs used to deploy onto the GPU fleet. Read-only, but the files it reaches are the ones that grant access everywhere else.

Who can reach it

An authenticated Jenkins user with Item/Create and Item/Configure permission, over HTTP. No host access required.

What to do

Upgrade Jenkins past 2.587, or LTS past 2.580.1, per the 2026-10-28 advisory, and restart the controller. Treat any credential readable by the controller process as potentially exposed if untrusted users held these permissions.

References

Related entries

• GitLab: group milestones API returns private-project milestone metadata without membershipCVE-2026-13319 · GitLab CE/EE group milestones API (project filter authorization)Medium
• GitLab CE/EE: malformed CSV import lets an authenticated user stall Sidekiq workersCVE-2026-1403 · GitLab CE/EE (CSV import, Sidekiq worker)Medium
• PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipherCVE-2026-14663 · PostgreSQL pgcrypto (pgp_sym_encrypt / pgp_pub_encrypt family)Medium
• Grafana: read-only Git Sync users can change a connection's configuration via its status subresourceCVE-2026-15577 · Grafana Git Sync provisioning (connection status subresource)Medium
• Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labelsCVE-2026-16100 · Keycloak (user-event Prometheus metrics)Medium
• Grafana: folder-admin check ignores the folder, exposing deleted dashboards from other foldersCVE-2026-16491 · Grafana RBAC service (folder-admin check ignores the requested folder for deleted dashboards)Medium