Jenkins Performance Plugin CVE-2026-84670

Exploitation requires a valid Jenkins account holding Item/Configure permission on at least one project - a permission level routinely granted to developers and project maintainers, not anonymous or guest users. The attacker must be able to write a malicious serialized object into the build directory on the Jenkins controller, which is achievable by users who can configure and trigger builds. No non-default plugin configuration is required beyond the Performance Plugin being installed. Unauthenticated or read-only access is insufficient (PR:L per CVSS confirms authentication is needed). The attack is not automatable at scale (SSVC: Automatable no) because it requires valid credentials and gadget-chain selection tailored to the target's Java classpath.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) accurately characterizes the threat: Jenkins is network-accessible and Item/Configure is a routine developer-level permission, meaning the attacker population is potentially large on any shared Jenkins instance. SSVC rates exploitation as 'none' and 'not automatable', consistent with the absence of KEV listing or public PoC - successful exploitation requires crafting a compatible Java gadget chain and having valid credentials, which raises the bar compared to a fully unauthenticated flaw. However, tooling such as ysoserial significantly lowers that bar, and the SSVC technical impact of 'total' reflects that a successful exploit yields complete Jenkins controller control. Even a development team running an internally exposed Jenkins instance should treat this as a high-priority patch, since Item/Configure is commonly delegated to developers who might be compromised through phishing or credential reuse. The gap between CVSS 8.8 and SSVC's non-automatable rating is consistent: this is a serious but not mass-exploitable flaw at current tooling maturity.

An attacker holding Item/Configure permission authenticates to the Jenkins instance, crafts a malicious Java serialized payload using a gadget chain compatible with the Jenkins classpath (e.g., via ysoserial), and places it in the build directory disguised as a cached performance report. When the Performance Plugin deserializes this file - either on page load, build trigger, or scheduled report aggregation - the gadget chain fires and executes arbitrary OS commands on the Jenkins controller as the Jenkins service account, granting access to all stored credentials, pipeline definitions, and connected infrastructure. No public exploit code has been identified at time of analysis, but the gadget-chain technique is well-documented in the Jenkins ecosystem.