Jenkins Remoting: JEP-200 deserialization filter bypassed via fallback class resolution on the controller

Impact

The JEP-200 class filter is not applied to classes resolved through a fallback path in Remoting's deserialization code, so anything on the Jenkins core classpath can be deserialized. Agent processes, code running on agents, and anyone holding Agent/Connect can use this to send gadget chains the filter was meant to stop - turning a build executor into a path toward the controller. In a GPU fleet the Jenkins controller is usually the account that pushes images, holds kubeconfigs and cloud credentials, and can schedule work on the cluster, so a compromise there is a fleet-wide credential problem. Build agents that run tenant or contributor code are the natural launch point, since agents are exactly the untrusted side of this trust boundary.

Who can reach it

A connected agent process, any code executing on an agent (a build step), or a network attacker holding the Agent/Connect permission. The agent-to-controller channel is the path; no controller-side authentication beyond agent connectivity is required.

What to do

Update Jenkins past the affected lines: the record names Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987) as bundled in Jenkins 2.575 and earlier and LTS 2.568.1 and earlier - check the 2026-08-05 advisory for the exact fixed release. Applying it means restarting the controller JVM, which aborts running builds and drops agent connections; agents reconnect and pick up the updated Remoting jar automatically. No node reboot is involved.

References

Related entries

• Crossplane package manager (cosign signature verification via ImageConfig): SUPPLY CHAIN, TIME-OF-CHECK TO TIME-OF-USENCVD-2026-055-crossplane-package-manager-cosig · Crossplane package manager (cosign signature verification via ImageConfig)Critical
• Ceph CephX: malleable, unauthenticated tickets let a low-privilege key be forged into Manager, MDS or OSD accessCVE-2025-30156 · Ceph CephX authentication protocol (unauthenticated AES-128-CBC ticket encryption)High
• Ceph CephX (authentication protocol): A tenant holding one low-privilege CephX client key ends up with cluster-wideNCVD-2025-016-ceph-cephx-authentication-protoc · Ceph CephX (authentication protocol)High
• GlusterFS (brick, server-rpc-fops.c): Multiple stack buffer overflows from fixed-size alloca() allocations in the brickCVE-2018-10907 · GlusterFS (brick, server-rpc-fops.c)High
• GlusterFS (brick, gfs3_symlink_req): Symlink creation is not confined to the volume, so a client plants a link pointingCVE-2018-10928 · GlusterFS (brick, gfs3_symlink_req)High
• NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3): Export policy rules marked read-only are notCVE-2018-5490 · NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3)High