Jenkins External Workspace Manager: path traversal in exwsAllocate reads any controller file

Impact

Version 1.3.2 and earlier accept path traversal sequences in the custom workspace path given to the exwsAllocate Pipeline step, so a user who can configure a job reads arbitrary files on the Jenkins controller filesystem - which the advisory notes can lead to remote code execution. The controller filesystem is where Jenkins keeps credentials stores, SSH keys and agent secrets, so this is a route from job-configure rights to the keys that drive the build and deploy path for a fleet. For operators who use external workspaces to stage large datasets or model artifacts for GPU builds, the affected step is in the normal pipeline path rather than an obscure feature.

Who can reach it

Any authenticated Jenkins user with Item/Configure permission on a job that can invoke the exwsAllocate step. No administrator rights needed.

What to do

Update the External Workspace Manager Plugin past 1.3.2 following the 2026-06-24 Jenkins advisory and restart the controller. If no fixed release is available for your line, remove or disable the plugin and withdraw Item/Configure from users who do not need it; rotate credentials held on the controller if you suspect the step was abused.

References

Related entries

• Jenkins OWASP ZAP Plugin: build operations run on the controller, giving Item/Configure users code executionCVE-2026-57301 · Jenkins OWASP ZAP Plugin (build steps executed on the controller instead of the agent)High
• Apache Airflow: executor_config deserialization imports arbitrary callables in scheduler and API serverCVE-2026-58076 · Apache Airflow serialization layer (exception branch reached via operator executor_config)High
• rclone (serve restic --private-repos): --private-repos is meant to confine each authenticated user to their ownCVE-2026-59733 · rclone (serve restic --private-repos)High
• Red Hat ACM: ManagedClusterAddOn annotation overrides governance-policy image, giving cluster-admin execCVE-2026-66793 · Red Hat Advanced Cluster Management governance-policy-addon-controllerHigh
• Apache Airflow: Callback deserialization in the scheduler timeout sweep imports Dag-author-chosen modulesCVE-2026-67587 · Apache Airflow Task SDK Callback deserialization (task instance next_kwargs)High
• Linux VXLAN driver (CAP_NET_ADMIN check on changelink across netns): A VXLAN tunnel's `changelink()` operates acrossCVE-2026-68432 · Linux VXLAN driver (CAP_NET_ADMIN check on changelink across netns)High