CVE-2026-53435

HIGH

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

Published June 10, 2026Updated August 13, 2026Source: osv

Summary

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.jenkins-ci.main:jenkins-core to 2.568 or later

<!-- Update pom.xml dependency version to 2.568 for org.jenkins-ci.main:jenkins-core -->

Maven

Update org.jenkins-ci.main:jenkins-core to 2.555.3 or later

<!-- Update pom.xml dependency version to 2.555.3 for org.jenkins-ci.main:jenkins-core -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Package	Ecosystem	Affected	Fixed In
org.jenkins-ci.main:jenkins-core	maven	2.556, 2.557, 2.558, 2.559 (+8 more)	2.568
org.jenkins-ci.main:jenkins-core	maven	1.396, 1.397, 1.398, 1.399 (+1011 more)	2.555.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-53435?: Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-53435?: CVE-2026-53435 affects org.jenkins-ci.main:jenkins-core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-53435 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-g2xq-2v27-4rh3

BIT-jenkins-2026-53435

Related CVEs

CVE-2017-1000353
CRITICAL
Deserialization of Untrusted Data in Jenkins
CVE-2016-9299
CRITICAL
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CVE-2024-23897
CRITICAL
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CVE-2017-1000362
CRITICAL
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
CVE-2018-1000861
CRITICAL
Deserialization of Untrusted Data in Jenkins
CVE-2016-0788
CRITICAL
Jenkins allows Execution of Code by Opening a JRMP Listener
CVE-2024-43044
HIGH
Jenkins Remoting library arbitrary file read vulnerability
CVE-2026-33001
HIGH
Jenkins has a link following vulnerability allows arbitrary file creation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies