CloudBees Security Advisory2026-10-28

Lack of authentication mechanism for Hazelcast connections in CloudBees High Availability (Active/Active) Plugin

BEE-74913

Severity (CVSS): Critical

Description:

CloudBees High Availability (Active/Active) Plugin forms a Hazelcast cluster between the replicas of a high availability (HA) controller. Replicas connect to each other on a TCP port, 5701 by default.

In CloudBees High Availability (Active/Active) Plugin 3423 and earlier, connections to this port are not authenticated.

This allows attackers able to connect to this port, including attackers able to control agent processes, to join the cluster and execute arbitrary code in the context of the controller JVM.

[!NOTE]

Administrators can block this port, for example using network policies on Kubernetes, but this is not the default configuration.

[/]

CloudBees High Availability (Active/Active) Plugin 3447 requires connections to this port to present a secret that is only accessible to the controller replicas.

[!NOTE]

Administrators can set the Java system property com.cloudbees.jenkins.plugins.replication.hazelcast.AuthenticatingNodeExtension.enabled to false to disable this fix.

[/]

[!TIP]

Connections to this port remain unencrypted at the TCP level, in common with most other internal CloudBees CI connections. If CloudBees CI runs in an unprotected network environment, installing a service mesh is recommended.

[/]

CloudBees CI bundles version of libbrotli vulnerable to CVE-2026-111497

BEE-75636

Severity (CVSS): High

Description:

CloudBees CI 2.580.1.38223 bundles versions of libbrotli that are susceptible to CVE-2026-111497.

This vulnerability allows attackers with Item/Configure permission able to checkout a Git repository from a server under their control on the controller to execute arbitrary code on the context of the controller JVM.

CloudBees CI 2.580.2.38434 bundles version libbrotli-1.0.9-10.el9_8.1 of libbrotli, which is unaffected by this issue.

CloudBees CI trusts compromised eMudhra intermediate certificate authorities

BEE-75515, BEE-75516, BEE-75517, BEE-75518, BEE-75519, BEE-75520, BEE-75521, BEE-75522

Severity (CVSS): High

Description:

CloudBees CI 2.580.1.38223 and earlier trust the emSign ECC Root CA - G3 root certificate in all CloudBees CI container images, in the Windows agent images, and in the Java runtime bundled with the Windows installer (MSI). The private keys of eight eMudhra intermediate certificate authorities (CAs) issued under this root are publicly recoverable (CVE-2026-111943).

Attackers who intercept network traffic can present certificates issued from these intermediate CAs for any domain, and so read and modify outbound TLS connections, including connections to source code repositories, the CloudBees update center, cloud storage providers, and identity providers.

CloudBees CI 2.580.2.38434 removes emSign ECC Root CA - G3, and the legacy AAA Certificate Services root used to cross-sign the affected intermediate CAs, from the trust stores of all affected images and of the bundled Java runtime.

Sidecar injector trusts compromised eMudhra intermediate certificate authorities

BEE-75523

Severity (CVSS): High

Description:

The sidecar-injector and cert-requester images prior to 480.198644476cde trust the emSign ECC Root CA - G3 root certificate. The private keys of eight eMudhra intermediate certificate authorities (CAs) issued under this root are publicly recoverable (CVE-2026-111943).

Attackers who intercept network traffic can present certificates issued from these intermediate CAs for any domain, and so read and modify the outbound TLS connections of these components.

The sidecar-injector and cert-requester images 483.2d9592c61776 and later no longer trust emSign ECC Root CA - G3, and are built with Go 1.27.3, which rejects certificate chains containing the compromised intermediate CAs.

Improper access control in CloudBees Analytics Plugin

BEE-74058

Severity (CVSS): Medium

Description:

Jenkins uses the Stapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties through methods annotated with @DataBoundSetter.

CloudBees Analytics Plugin 1.903 and earlier uses the @DataBoundConstructor annotation on a constructor, enabling Stapler to invoke @DataBoundSetter annotated methods that manage the plugin's usage statistics configuration.

This allows attackers able to submit certain forms to suppress the administrative monitor that warns administrators when the analytics event queue is overwhelmed.

CloudBees Analytics Plugin 1.906 removes the @DataBoundConstructor annotation from the constructor for the plugin's global configuration as it is not intended to be invoked by users.

RCE vulnerability in XStream deserialization due to improper `resolves-to` attribute handling

SECURITY-4125 / CVE-2026-117612

Severity (CVSS): High

Description:

Jenkins uses XStream for serialization and deserialization of configuration and build data. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that only allows deserialization of types defined in Jenkins core or plugins, or explicitly allowed types (JEP-200). These vulnerabilities generally rely on behavior defined in #readResolve methods that are executed during deserialization.

The custom XStream converter used by CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply the deserialization filter to classes referenced by the resolves-to attribute. This allows attackers to instantiate arbitrary types during deserialization, potentially leading to remote code execution. To do this, attackers need to have Overall/Read permission, and at least one of the following:

• a user account (i.e., cannot be anonymous)
• any set of permissions allowing them to POST config.xml (e.g., Item/Configure, View/Configure, Agent/Configure).

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 applies the deserialization filter to classes referenced by the resolves-to attribute. Additionally, CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 newly uses the XStream type permissions system (in addition to its own custom converters) to enforce allowed types during deserialization.

[!NOTE]

In case of problems with the addition to the type permission system, administrators can disable it by setting the Java system property hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION to true.

[/]

Collection element type check bypass vulnerability

SECURITY-4225 / CVE-2026-117613

Severity (CVSS): High

Description:

Jenkins uses XStream for serialization and deserialization of configuration and build data. The ability to provide XML documents to XStream is exposed to users who hold the respective */Configure permission, e.g., the item POST config.xml API is available with Item/Configure permission.

XStream by itself does not restrict the types of collection elements after deserialization. While some converters in Jenkins restrict collection element types (see SECURITY-3707 in the 2026-06-10 security advisory), not all converters restrict element types.

In CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier this allows attackers with Item/Configure permission to submit a crafted job config.xml file that causes a stored cross-site scripting (XSS) vulnerability.

[!TIP]

On CloudBees CI 2.541.1.35570 and newer, Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates the known impact of this vulnerability.

[/]

Other XSS vulnerabilities, or other vulnerability types stemming from unexpected collection element types, may also be possible.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 adds a post-processing step after collection deserialization and confirms all elements are of the expected types.

[!NOTE]

In case of problems caused by the element type validation, administrators can disable it entirely by setting the Java system property hudson.util.RobustReflectionConverter.skipFieldValueElementTypeCheck to true. Deserialization fails by default if more than 1,000,000 collection or map elements are type-checked during a single operation. The limit can be changed by setting the Java system property hudson.util.RobustReflectionConverter.fieldValueElementCheckLimit to a different value. In case of problems caused by internal state that prevents collection or map fields from being iterated after deserialization, administrators can suppress these errors by setting the Java system property hudson.util.RobustReflectionConverter.acceptNonIterableCollections to true.

[/]

Agent launch command approval bypass vulnerability

SECURITY-4123 / CVE-2026-117614

Severity (CVSS): High

Description:

Since CloudBees CI 2.89.1.1, Jenkins 2.86, LTS 2.89.1 launching agents by running a command on the controller is implemented in the Command Agent Launcher Plugin rather than in Jenkins.

For backward compatibility with older agent configurations, CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands they contain into launchers provided by this plugin.

This conversion does not check whether the launch command has been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 no longer converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin.

Link following vulnerability allows arbitrary file read

SECURITY-4187 / CVE-2026-117615

Severity (CVSS): High

Description:

When renaming an item, Jenkins moves its directory on the controller file system, or copies it if it cannot be moved.

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed.

This allows attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution (see Reading Files).

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 no longer copies the directory of an item being renamed if it contains symbolic links.

Path traversal vulnerability in agent names

SECURITY-4188 / CVE-2026-117616

Severity (CVSS): High

Description:

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, so that any config.xml file on the controller file system can be loaded, as an agent carrying the name declared in that file.

This allows attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, replacing the configuration of an existing agent or defining a new agent. The name declared in that file also determines where the agent’s configuration is written. When this agent is saved, Jenkins overwrites the config.xml file at that location, potentially resulting in arbitrary code execution.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 no longer allows loading agents by name through HTTP requests. Additionally, when agents are loaded by name, it now validates the name and rejects configurations whose declared name differs from the requested name.

Race condition in artifact extraction allows arbitrary file creation

SECURITY-4248 / CVE-2026-117617

Severity (CVSS): High

Description:

To prevent writing files outside the target directory, Jenkins refuses to write files through symbolic links when extracting archived artifacts on the controller.

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories.

This allows attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system by archiving artifacts concurrently, e.g., from parallel branches of a Pipeline, which can lead to remote code execution (see Writing Files).

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 checks for symbolic links in the path of an extracted file immediately before writing it, and does not allow symbolic links in artifacts to replace existing files or directories.

XSS vulnerability in workspace browser

SECURITY-4232 / CVE-2026-117621

Severity (CVSS): High

Description:

When the workspace of a job is located on an agent, Jenkins retrieves the list of files and directories shown in the workspace browser from that agent.

In CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the agent computes the URL of the link shown for each file and directory.

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

[!TIP]

On CloudBees CI 2.541.1.35570 and newer, Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability.

[/]

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 computes on the controller the URL of the link shown for each file and directory in the workspace browser.

XSS vulnerability in handling of agent errors

SECURITY-4249 / CVE-2026-117622

Severity (CVSS): High

Description:

To protect against deserialization vulnerabilities, Jenkins restricts the types of objects that agents can send to the controller (JEP-200).

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface, and renders them as HTTP responses.

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 does not allow agents to send exceptions implementing the Stapler HttpResponse interface. Additionally, CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 sets a restrictive Content-Security-Policy header on HTTP responses for form fill failures.

Stored XSS vulnerability in breadcrumb bar overflow menu

SECURITY-4229 / CVE-2026-117623

Severity (CVSS): High

Description:

When the breadcrumb bar does not fit in the browser window, Jenkins moves breadcrumbs into an overflow menu, and shows the full text of long breadcrumbs, such as job, build, or user names, in a tooltip.

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in these tooltips.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

[!TIP]

On CloudBees CI 2.541.1.35570 and newer, Jenkins 2.539 and newer, LTS 2.541.1 and newer, enforcing Content Security Policy protection mitigates this vulnerability.

[/]

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 escapes the text shown in the tooltips of breadcrumb bar overflow menu entries.

Race condition in setup wizard allows creating an administrator account

SECURITY-4122 / CVE-2026-117618

Severity (CVSS): High

Description:

By default, the initial setup of Jenkins configures the "Jenkins' own user database" security realm and the "Logged-in users can do anything" authorization strategy, and creates an initial user account. During the setup wizard, administrators can create a new administrator account, in which case Jenkins deletes the initial account and then creates the new account.

To prevent administrators from being locked out, the "Jenkins' own user database" security realm provides an HTTP endpoint that allows unauthenticated users to create a user account while no user accounts exist.

In CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, this HTTP endpoint does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial account is being replaced.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 checks whether the setup wizard has been completed before allowing the creation of a user account through the affected HTTP endpoint.

Insufficient session expiration vulnerability

SECURITY-4189 / CVE-2026-117619

Severity (CVSS): High

Description:

Jenkins’s "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again. The validity of this cookie does not depend on the credentials used to obtain it.

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie.

This allows attackers who have obtained a user’s API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 no longer allows requests authenticated using HTTP Basic authentication to obtain a "remember me" cookie.

Old Data Monitor injection lets users take over administrator accounts

SECURITY-4226 / CVE-2026-117620

Severity (CVSS): High

Description:

Jenkins uses XStream for serialization and deserialization of configuration and build data. The ability to provide XML documents to XStream is exposed to users who hold the respective */Configure permission, e.g., the item POST config.xml API is available with Item/Configure permission.

When invalid data (e.g., data for a field that no longer exists) is loaded, this is recorded by the "Manage Old Data" feature if the data is being loaded from disk to allow administrators to review and correct any errors. It also allows saving the invalid objects again to remove any stored obsolete data.

In CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, some of the code paths to report invalid data are not restricted to data being loaded from disk. This allows attackers with Overall/Read permission to trigger a warning in the "Manage Old Data" feature. When an administrator acts on the warning, it can override a Jenkins user account’s data with attacker-controlled content. On controllers using Jenkins’s own user database, this includes the password for that user account, so that the attacker can log in as that user afterwards.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 ensures that warnings in "Manage Old Data" can only be triggered when loading data from disk, not from user-submitted XML, preventing attackers from injecting data this way.

Root element restriction bypass in XStream deserialization

SECURITY-4243 / CVE-2026-117624

Severity (CVSS): High

Description:

Jenkins uses XStream for serialization and deserialization of configuration and build data. Types storing their configuration in their own files (usually config.xml or build.xml), like agents, items, or builds, are indicated as such by implementing the Java interface PersistenceRoot.

Since SECURITY-3972 in the 2026-09-02 security advisory, Jenkins attempts to prevent objects of types marked as storing their configuration in independent top-level configuration files in Jenkins from being deserialized as nested values in the configuration of other objects.

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce this restriction, allowing attackers to bypass the root element check and potentially inject malicious nested objects.

As of publication, the confirmed impact of this vulnerability is limited to the creation of new user records (name and display name only), similar to users appearing in SCM logs. Notably, no new user accounts with the ability to log in can be created (unlike in SECURITY-4226).

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 ensures that objects of types marked as storing their configuration in independent top-level configuration files in Jenkins cannot be deserialized as nested values in other objects, preventing attackers from bypassing the root element check.

Missing permission check allows obtaining HTTP proxy configuration

SECURITY-4206 / CVE-2026-117625

Severity (CVSS): Medium

Description:

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 requires Overall/Administer permission for the affected HTTP endpoint.

Path traversal vulnerability in file browser

SECURITY-4237 / CVE-2026-117626

Severity (CVSS): Medium

Description:

CloudBees CI 2.580.1.38223 and earlier, Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/.

This allows attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in $JENKINS_HOME. Additionally, it allows attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.

CloudBees CI 2.580.2.38434, Jenkins 2.588, LTS 2.580.2 improves the identification of file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/.

‍

• SECURITY-4122: High
• SECURITY-4123: High
• SECURITY-4125: High
• SECURITY-4187: High
• SECURITY-4188: High
• SECURITY-4189: High
• SECURITY-4206: Medium
• SECURITY-4225: High
• SECURITY-4226: High
• SECURITY-4229: High
• SECURITY-4232: High
• SECURITY-4237: Medium
• SECURITY-4243: High
• SECURITY-4248: High
• SECURITY-4249: High

• CloudBees Traditional Platforms should be upgraded to 2.580.2.38434.
• CloudBees Cloud Platforms should be upgraded to 2.580.2.38434.

• Anthropic OSS program for SECURITY-4187, SECURITY-4188, SECURITY-4189, SECURITY-4206, SECURITY-4225, SECURITY-4226, SECURITY-4229, SECURITY-4232, SECURITY-4237, SECURITY-4243
• Bilishee from the Xmirror Security Team; and, independently, Anthropic OSS program for SECURITY-4125
• Jongyeon Lee (2jo); and, independently, Anthropic OSS program for SECURITY-4122, SECURITY-4123
• Samy Medjahed (Ap4sh) for SECURITY-4248, SECURITY-4249