EUVD-2026-26222Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
PR:L confirmed by Item/Configure permission requirement; C:L added over vendor C:N because description explicitly cites information disclosure as a potential outcome.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
AnalysisAI
Unsafe deserialization in Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allows an authenticated user with Item/Configure permission to instantiate arbitrary Java classes from the Jenkins classpath by specifying class names in job configuration. The vulnerability arises because the plugin invokes parameterless constructors of user-specified classes when deserializing inheritance strategies without type restriction. No public exploit is identified at time of analysis, and SSVC signals exploitation as none, but the real-world impact depends on the richness of the Jenkins classpath - gadget classes available in that environment determine the attacker's effective reach.
Technical ContextAI
CWE-502 (Deserialization of Untrusted Data) describes the root cause: the plugin accepts attacker-controlled class names in serialized configuration data and reflectively instantiates those classes via their parameterless constructors without any allowlist or type-safety check. In Jenkins' plugin ecosystem, the classpath is typically large and includes many third-party libraries, which expands the pool of exploitable constructor side effects (e.g., JNDI lookups, file operations, network connections triggered by static initializers or constructors). The affected CPE is cpe:2.3:a:jenkins_project:jenkins_matrix_authorization_strategy_plugin:*:*:*:*:*:*:*:*, confirming the affected artifact is the Jenkins Project's Matrix Authorization Strategy Plugin specifically. This plugin is widely used to implement role-based or matrix-style authorization in Jenkins instances. The deserialization occurs during the processing of inheritance strategy configuration, a feature that allows administrators and permissioned users to define how authorization rules propagate across items.
RemediationAI
Upgrade the Jenkins Matrix Authorization Strategy Plugin to a version beyond 3.2.9 per the vendor-released patch available through the Jenkins update center. Exact fixed version should be confirmed by consulting the vendor advisory at https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3676, as the precise patched version number is not independently confirmed in available intelligence. As a compensating control where immediate upgrading is not possible, restrict the Item/Configure permission to the smallest set of trusted users, since exploitation requires this specific permission - note that this may reduce team autonomy and affect pipeline management workflows. Additionally, reviewing the Jenkins classpath for high-impact gadget libraries (e.g., those with JNDI-triggering constructors) and removing unnecessary dependencies can reduce the blast radius of exploitation, though this is operationally complex and should not substitute for patching.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today