Database/Control plane, storage & DevOps
Jenkins File Parameter Plugin: arbitrary file write on the controller via data binding leads to RCE
Impact
The plugin allows writing files to arbitrary locations on the Jenkins controller filesystem through Stapler data binding, which the advisory states can lead to remote code execution. Arbitrary write on a controller is a short path to persistence - init scripts, plugin directories, cron - and from there to the credentials that let the controller deploy onto the GPU fleet. Anything the controller can push to, including container registries and cluster API endpoints, inherits the compromise. Affects File Parameter Plugin 425.v3fa_801681b_5e and earlier.
Who can reach it
An authenticated Jenkins user with low privileges reaching the data binding path. No user interaction required.
What to do
Update the File Parameter Plugin past 425.v3fa_801681b_5e and restart the controller; the record does not name the fixed release. If the plugin is not in use, remove it. After patching, check the controller filesystem and plugin directory for unexpected files, since an upgrade does not remove anything already written. Short CI outage.
References
Related entries
- Jenkins Entra ID plugin: a colliding Entra group display name inherits a privileged group's permissionsCVE-2026-84672 · Jenkins Microsoft Entra ID plugin (group authorization by display name)High
- Jenkins Customizable Header Plugin: SVG icon config injection yields stored XSS on every pageCVE-2026-84673 · Jenkins Customizable Header Plugin (appearance configuration)High
- Airflow Kafka provider: connection editor gains code execution inside the scheduler processCVE-2026-86792 · Apache Airflow Apache Kafka provider (connection `extra` callable resolution)High
- Windows Server for NFS: out-of-bounds read allows remote code execution against the NFS serverCVE-2026-88115 · Windows Server for NFS (Server for NFS role, Windows Server 2012-2016)High
- ansible-core: symlink chain in a collection tarball writes files outside the install directoryCVE-2026-89091 · ansible-core (ansible-galaxy collection install archive extractor)High
- Oracle ZFS Storage Appliance Kit: low-privileged HTTP request takes over the storage controllerCVE-2026-91527 · Oracle ZFS Storage Appliance Kit 8.8 (Core)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.