Database/Control plane, storage & DevOps
Jenkins Performance Plugin: unsafe deserialization of cached reports gives Item/Configure users RCE
Impact
The plugin does not restrict which classes may be instantiated when it deserializes cached performance reports from the build directory, so a user with Item/Configure can place crafted cached data and execute arbitrary code on the Jenkins controller. Controller code execution is full compromise of the CI identity: the credentials store, agent connections to every build node, and push access to the registries that GPU nodes pull from. Item/Configure is normally seen as a routine developer permission, not an administrative one, which is what makes this a privilege escalation rather than a nuisance. Affects Performance Plugin 1015.v09ca_52b_3370e and earlier.
Who can reach it
An authenticated user with Item/Configure permission on a job using the Performance Plugin. No user interaction required.
What to do
Update the Performance Plugin past 1015.v09ca_52b_3370e and restart the controller; the record does not name the fixed release, so check the advisory. If the plugin is unused, uninstalling it removes the exposure with the same restart. Short CI outage, no node drain.
References
Related entries
- Jenkins File Parameter Plugin: arbitrary file write on the controller via data binding leads to RCECVE-2026-84671 · Jenkins File Parameter Plugin (Stapler data binding, file write path)High
- Jenkins Entra ID plugin: a colliding Entra group display name inherits a privileged group's permissionsCVE-2026-84672 · Jenkins Microsoft Entra ID plugin (group authorization by display name)High
- Jenkins Customizable Header Plugin: SVG icon config injection yields stored XSS on every pageCVE-2026-84673 · Jenkins Customizable Header Plugin (appearance configuration)High
- Airflow Kafka provider: connection editor gains code execution inside the scheduler processCVE-2026-86792 · Apache Airflow Apache Kafka provider (connection `extra` callable resolution)High
- Windows Server for NFS: out-of-bounds read allows remote code execution against the NFS serverCVE-2026-88115 · Windows Server for NFS (Server for NFS role, Windows Server 2012-2016)High
- ansible-core: symlink chain in a collection tarball writes files outside the install directoryCVE-2026-89091 · ansible-core (ansible-galaxy collection install archive extractor)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.