Jenkins CVE-2026-70446

Jenkins is a widely deployed open-source CI/CD automation server built on the Java platform. The most critical flaw (CVE-2026-70426) resides in the Remoting library (agent.jar/remoting.jar), which handles controller-agent communication via serialized Java objects. Jenkins enforces the JEP-200 class filter to prevent deserialization gadget attacks, but a fallback class resolution path in Remoting 3384.v60d89463d9e0 and earlier bypasses this filter entirely, exposing arbitrary Jenkins core classpath classes to deserialization exploitation. CVE-2026-70427 exploits tar/tar.gz extraction logic that fails to properly handle symbolic links with effectively empty names, enabling directory traversal to write files to sensitive controller locations such as JENKINS_HOME/init.groovy.d/ (auto-executed Groovy) or JENKINS_HOME/plugins/. CVE-2026-70428 reflects an improper path traversal detection failure in file parameter name handling (CWE-22 family). CVE-2026-70429 exploits a subtle inconsistency between Java's String#toLowerCase used for canonical ID creation and String#equalsIgnoreCase used for runtime comparisons: certain Unicode characters such as dotless-i ('ı') fold to different characters under each method, enabling identity collision without matching character sets. CVE-2026-70430 is an unsafe deserialization or reflection-based type instantiation issue in the project naming strategy subsystem. The Multijob Plugin CVEs (CVE-2026-70431/70432) involve Groovy scripting execution paths that do not integrate with the Jenkins Script Security Plugin sandbox, permitting unsandboxed JVM-level code execution.