Database/Control plane, storage & DevOps
Jenkins: root element check bypass allows nesting types meant to live only in top-level config files
Impact
Jenkins refuses to deserialize types that store their configuration in independent top-level files when they appear nested inside other data, but the restriction is not enforced consistently. An attacker can bypass the root element check and inject nested objects of those types, broadening what attacker-controlled XML can construct inside the controller. This is a deserialization hardening bypass rather than a demonstrated single gadget, so judge it alongside the other XStream fix in the same advisory. Scored 8.8 by the CNA.
Who can reach it
Network, authenticated with low privilege, via any input the controller deserializes with XStream.
What to do
Upgrade to the fixed weekly and LTS releases from the 2026-10-28 advisory and restart the controller; the fixed version numbers are not in this record. Controller-only change, no build node work.
References
Related entries
- MinIO: unsigned x-amz-* headers accepted in SigV4, escalating a presigned PUT into a cross-bucket readCVE-2026-122267 · MinIO (S3 Signature V4 verification)High
- Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High
- Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
- NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentialsCVE-2026-22049 · NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID)High
- Apache CloudStack: an account user registering a KVM template executes arbitrary code on the KVM hostsCVE-2026-25077 · Apache CloudStack (KVM template registration, direct-download file name handling)High
- Apache Airflow: documented BashOperator pattern lets a UI user inject commands onto the worker via dag_run.confCVE-2026-30898 · Apache Airflow BashOperator documentation example (dag_run.conf templating)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.