Jenkins CVE-2026-70442

CVE-2026-70426 requires Agent/Connect permission or the ability to control an agent process - a condition met by any developer who can connect a build agent in shared Jenkins deployments, or by an attacker who has compromised an existing agent. The affected code path is in Remoting 3384.v60d89463d9e0 and earlier; the backport fix is available in the 3355.3357.v931d3c992987 branch. CVE-2026-70427 similarly requires control of an agent process capable of delivering a crafted tar/tar.gz archive to the controller during extraction; no special configuration beyond a functioning agent connection is needed. CVE-2026-70428 requires both Item/Configure and Item/Build permissions simultaneously - a combination typical of project owners or pipeline developers. CVE-2026-70429 is limited to environments using a security realm that allows Unicode characters outside ASCII in usernames or group names, and that permits registration of names case-insensitively matching existing accounts; the built-in Jenkins user database explicitly prevents this by rejecting non-ASCII usernames, so only external LDAP/SSO realms with permissive character policies are vulnerable. CVE-2026-70430 requires Overall/Manage, a high-privilege role typically restricted to Jenkins administrators. CVE-2026-70431 requires Item/Create or Item/Configure permission plus the Multijob Plugin being installed and enabled.

No CVSS score or vector was provided in the input data, and no EPSS probability or CISA KEV listing is present. Risk must therefore be inferred from the technical descriptions alone. The Remoting deserialization bypass (CVE-2026-70426) is the highest-severity issue: exploitation requires only Agent/Connect permission or control of an agent process - a realistic posture in any shared Jenkins environment or in CI pipelines building untrusted code - and yields full code execution on the controller JVM. Similarly, CVE-2026-70427 allows an agent operator to achieve arbitrary file writes and likely code execution with no exploitation complexity beyond supplying a crafted archive. CVE-2026-70428 requires Item/Configure plus Item/Build permissions, which are commonly granted to developers, and also leads to arbitrary writes and code execution. CVE-2026-70430 requires Overall/Manage, limiting blast radius. CVE-2026-70429 is constrained to environments using external security realms that permit Unicode usernames outside ASCII - the built-in Jenkins user database explicitly does not, reducing realistic exposure. The Multijob Plugin RCE (CVE-2026-70431) requires Item/Create or Item/Configure, again a broadly-held permission in practice. Collectively, the controller-targeting RCE vectors (CVE-2026-70426 and CVE-2026-70427) represent critical-priority issues despite the absence of formal CVSS scores. The plugin issues with unresolved status represent ongoing exposure with no patch ETA.

An attacker with an established Jenkins agent connection (or Agent/Connect permission, which developers routinely hold) sends a crafted serialized Java object over the Remoting channel that resolves through the bypassed fallback deserialization path, instantiating a class on the Jenkins core classpath not blocked by the pre-JEP-200 denylist. Alternatively, the same attacker supplies a malicious tar.gz archive through an agent task; extraction on the controller writes a Groovy init script to JENKINS_HOME/init.groovy.d/, which executes on the next Jenkins restart with controller-level JVM privileges. No public exploit code was identified at time of analysis, but the technical primitive (Java deserialization gadget chains via classpath classes) is well-understood in the security research community.