Jenkins: symlinks with empty names in agent tar archives write arbitrary files on the controller

Impact

Symbolic links with effectively empty names are not handled safely when the controller extracts a .tar or .tar.gz sent up from an agent, so an attacker who controls an agent process can write files anywhere the Jenkins user can write. In a GPU shop the build agents are usually the least trusted component in the pipeline - untrusted training and test code runs there, often in containers on the GPU nodes themselves - while the controller holds registry push credentials and kubeconfigs for the training clusters. An arbitrary file write on the controller is a plausible stepping stone to code execution on it (init scripts, plugin and job directories) and from there into the image supply chain feeding every node. Jenkins scores it 4.3, integrity impact only; no direct code execution is claimed in the advisory.

Who can reach it

Anyone able to control an agent process, which includes an attacker who has compromised a build running on an agent. Needs an existing agent connection to the controller, not controller login credentials.

What to do

Upgrade to a Jenkins weekly release after 2.575 or LTS after 2.568.1 per SECURITY-3930 in the 2026-08-05 advisory. Cost is a controller restart: the queue pauses, agents reconnect, and in-flight builds are lost unless you drain them first. No GPU node maintenance is involved.

References

Related entries

• Jenkins: path traversal in file parameter names writes arbitrary files on the controller filesystemCVE-2026-70428 · Jenkins controller (path traversal in file parameter names)Medium
• GitLab: developer-role user can replace package file content and hide packages from ownersCVE-2026-7514 · GitLab CE/EE (Generic Package Registry authorization)Medium
• Apache Airflow: /assets/events returns asset events for every DAG, ignoring per-DAG access controlCVE-2026-75158 · Apache Airflow core API (/assets/events endpoint)Medium
• HPE OneView: remotely triggerable URL redirect in the management consoleCVE-2026-76720 · HPE OneView (open URL redirect)Medium
• Jenkins core: crafted XML submission lets a read-only user create user objects on the controllerCVE-2026-84646 · Jenkins core (XML deserialization, user objects as nested field values)Medium
• Jenkins core: unescaped map keys let a user inject arbitrary fields into JSON and Python API responsesCVE-2026-84655 · Jenkins core (REST API JSON and Python serialization, unescaped map keys)Medium