CVE-2026-53435: In Jenkins 2

Synopsis

This is a deserialization vulnerability in Jenkins 2.567 and earlier (LTS 2.555.2 and earlier). An authenticated attacker with any level of access can submit a crafted config.xml file that causes Jenkins to deserialize attacker-controlled types, which then handle live HTTP requests. Successful exploitation lets the attacker impersonate any user, execute arbitrary code via the Script Console, or read arbitrary files from the Jenkins controller. A patched-image rebuild is available on HarborGuard for environments running an affected version, targeting fix versions 2.555.3 or 2.568.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Jenkins HTTP interface over the network to submit the malicious config.xml payload.

• AuthenticationRequired

  Any low-privilege Jenkins account is sufficient; no administrative credentials are needed to trigger the deserialization.

• Victim interactionNot required

  No victim action is needed; the attacker submits the payload directly without requiring any user to click or approve anything.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required to deliver the payload.

Blast Radius

• The attacker can impersonate any Jenkins user, including administrators, and issue authenticated HTTP requests on their behalf.
• Using the impersonated session, the attacker can access the Script Console and run arbitrary code on the Jenkins controller host.
• The attacker can read arbitrary files from the Jenkins controller filesystem, including credentials, secrets, and pipeline configuration files.
• All confidentiality, integrity, and availability of the Jenkins controller and its stored build data are compromised.