CVE-2018-1000861

CRITICAL

Actively Exploited

Deserialization of Untrusted Data in Jenkins

Published May 13, 2022Updated October 22, 2025Source: osv

What Should I Do?

Patch Immediately

This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.

Summary

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.jenkins-ci.main:jenkins-core to 2.154 or later

<!-- Update pom.xml dependency version to 2.154 for org.jenkins-ci.main:jenkins-core -->

Maven

Update org.jenkins-ci.main:jenkins-core to 2.138.4 or later

<!-- Update pom.xml dependency version to 2.138.4 for org.jenkins-ci.main:jenkins-core -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Package	Ecosystem	Affected	Fixed In
org.jenkins-ci.main:jenkins-core	maven	2.140, 2.141, 2.142, 2.143 (+13 more)	2.154
org.jenkins-ci.main:jenkins-core	maven	1.396, 1.397, 1.398, 1.399 (+497 more)	2.138.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

References

Frequently Asked Questions

What is CVE-2018-1000861?: Deserialization of Untrusted Data in Jenkins This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2018-1000861?: CVE-2018-1000861 affects org.jenkins-ci.main:jenkins-core. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-1000861 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Known Exploited Vulnerability

This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Remediation deadline: August 10, 2022

Also Known As

GHSA-hhpm-5cp2-hg4x

Related CVEs

CVE-2017-1000353
CRITICAL
Deserialization of Untrusted Data in Jenkins
CVE-2016-9299
CRITICAL
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CVE-2024-23897
CRITICAL
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CVE-2017-1000362
CRITICAL
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
CVE-2016-0788
CRITICAL
Jenkins allows Execution of Code by Opening a JRMP Listener
CVE-2026-53435
HIGH
Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
CVE-2024-43044
HIGH
Jenkins Remoting library arbitrary file read vulnerability
CVE-2026-33001
HIGH
Jenkins has a link following vulnerability allows arbitrary file creation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies