Jenkins: symlinks in tar archives let a job or agent write files anywhere the controller can

Impact

Jenkins 2.554 and earlier, and LTS 2.541.2 and earlier, do not handle symbolic links safely when extracting .tar and .tar.gz archives, so a crafted archive writes outside the intended directory - bounded only by the filesystem permissions of the Jenkins user. A user with Item/Configure, or anyone who controls an agent process, can use this to drop scripts or plugins onto the controller and reach code execution there. On a GPU fleet the Jenkins controller is usually the thing that holds registry credentials, cluster kubeconfigs and node-provisioning secrets, and build agents frequently run on the GPU nodes themselves, which makes "an agent can write to the controller" an escalation from one tenant's build to the whole cluster's credentials. Red Hat ships the same flaw in OpenShift Developer Tools and Services 4.12 through 4.16.

Who can reach it

Authenticated, but low privilege: any user holding Item/Configure on the controller, or an attacker who has taken over a build agent process, which includes a tenant able to influence what runs on a shared agent.

What to do

Upgrade the controller past the affected lines (2.554 / LTS 2.541.2) per the Jenkins 2026-03-18 advisory (SECURITY-3657) and restart Jenkins; on OpenShift, apply the corresponding RHSA errata for Developer Tools and Services. The advisory text in this record does not name the fixed version, so take it from the Jenkins advisory rather than assuming one. Until you can restart, tighten Item/Configure grants and treat every agent as able to write to the controller filesystem - do not run untrusted tenant builds on agents attached to a production controller.

References

Related entries

• Apache ActiveMQ: Improper input validation and code injection in the brokerCVE-2026-34197 · Apache ActiveMQHigh
• Supermicro SMASH service (X14DBG-DAP, X14DBI): An attacker with any authorised BMC login escalates through the SMASHCVE-2026-3821 · Supermicro SMASH service (X14DBG-DAP, X14DBI)High
• Ceph RGW: unauthenticated STS token encryption lets any token holder bit-flip themselves to RGW adminCVE-2026-39944 · Ceph RADOS Gateway (STS session token AES-128-CBC handler)High
• MinIO (S3 API, Snowball auto-extract): The Snowball auto-extract path skips signature verification entirely, so anCVE-2026-40344 · MinIO (S3 API, Snowball auto-extract)High
• MinIO (S3 API, unsigned-trailer uploads): The signature on a query-string-credential unsigned-trailer upload is notCVE-2026-41145 · MinIO (S3 API, unsigned-trailer uploads)High
• VMware Avi Load Balancer: remote code execution on the Avi Controller control planeCVE-2026-47867 · VMware Avi Load Balancer (Controller control plane)High