SecurityOnlineDo Son
Critical Jenkins flaw lets attackers bypass filter for RCE
Part of the CVE-2026-70426 story · since 6 Aug
- Thu 6 Aug, 03:21 UTC. SecurityOnline, first report. Critical Jenkins flaw lets attackers bypass filter for RCE. This article, 1st of 1.
A critical vulnerability, CVE-2026-70426, has been identified in Jenkins that allows attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter, enabling remote code execution (RCE) on the controller. This flaw poses a significant risk as it can expose sensitive information within CI/CD pipelines. The vulnerability affects Jenkins versions up to 2.575 (weekly) and 2.568.1 (LTS). Patching is urgent; users should update to Jenkins 2.576 (weekly) or 2.568.2 (LTS).
Additionally, related vulnerabilities include CVE-2026-70427, which allows arbitrary file creation, and CVE-2026-70428, which permits path traversal in file parameters. There are no confirmed exploitations in the wild as of now.
How the story developed
1 article from 1 outlet since 6 Aug. Quiet since 6 Aug. This was the first report.
- Thu 6 Aug, 03:21 UTC. SecurityOnline, first report. Critical Jenkins flaw lets attackers bypass filter for RCE. This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Thu 6 AugDay 01
- Critical Jenkins flaw lets attackers bypass filter for RCE03:21 · SecurityOnline · First report · This article, 1st of 1