Database/Control plane, storage & DevOps
Jenkins: symlinks in artifacts let a job configurer write files anywhere on the controller filesystem
Impact
Jenkins checks for symbolic links in an extracted file's path only before creating parent directories, not immediately before the write, and permits symlinks in artifacts to replace existing files or empty directories. A user with Item/Configure can therefore have artifact extraction write to arbitrary paths on the controller filesystem. Writing into Jenkins' own configuration or plugin directories converts job-configure rights into controller compromise, which on a GPU cluster carries the deploy credentials for the whole fleet. Integrity and availability impact only; the CNA scores it 8.1.
Who can reach it
Network, authenticated user holding Item/Configure on any job whose artifacts the controller extracts.
What to do
Upgrade to the fixed weekly and LTS releases from the 2026-10-28 advisory and restart the controller; the fixed versions are not stated in this record. In the meantime, treat Item/Configure as an administrative privilege and audit who holds it.
References
Related entries
- Jenkins: unauthenticated race on the setup wizard endpoint can create an administrator accountCVE-2026-117618 · Jenkins controller (first-user-account setup wizard endpoint)High
- Jenkins: API-token requests can mint a remember-me cookie that survives token revocationCVE-2026-117619 · Jenkins controller (HTTP Basic / API token authentication, "remember me" cookie)High
- N-able N-central: Incomplete patch for CVE-2026-18556CVE-2026-18577 · N-able N-centralHigh
- VMware Aria Operations (command injection during assisted migration): An unauthenticated attacker injects commandsCVE-2026-22719 · VMware Aria Operations (command injection during assisted migration)High
- Grafana Snowflake datasource: query access allows reading and writing files on the Grafana serverCVE-2026-28381 · Grafana Snowflake datasource (GET/PUT file commands)High
- Apache Airflow: any authenticated task instance can read or decide another task instance's HITL approvalsCVE-2026-30911 · Apache Airflow Execution API (Human-in-the-Loop endpoints)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.