What is the CVSS score of EUVD-2026-53570?

EUVD-2026-53570 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Jenkins are affected by EUVD-2026-53570?

Jenkins versions 2.575 and earlier contain a critical arbitrary file write vulnerability allowing compromised agent processes to write directly to the Jenkins controller filesystem, enabling remote…

How to fix or mitigate EUVD-2026-53570?

Within 24 hours, inventory all Jenkins instances and identify those running version 2.575 or earlier, and document the number and criticality of connected agents. Within 7 days, implement immediate compensating controls including network segmentation to restrict agent-to-controller communication, disable agent features not actively in use, and implement strict file integrity monitoring on JENKINS_HOME/init.groovy.d/ and JENKINS_HOME/plugins/ directories. Within 30 days, establish a monitoring cadence for vendor patch announcements and develop an upgrade strategy to move to patched versions as they become available, prioritizing disconnection or isolation of vulnerable controller instances in lower-risk environments as interim containment.

Jenkins EUVD-2026-53570

| CVE-2026-70427 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-08-05

GHSA-xvrr-fjq7-cfrw

Information Disclosure Jenkins

4.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

9.9 CRITICAL

Archive delivered over Remoting network channel by low-privilege agent; scope changes to controller with full C/I/A impact via resulting RCE.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 19:22 NVD

4.3 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 16:20 vuln.today

CVE Published

Aug 05, 2026 - 14:02 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Arbitrary file write via crafted tar archive extraction in Jenkins 2.575 and earlier allows attackers controlling agent processes to escape extraction directory boundaries on the controller filesystem, directly enabling remote code execution. The root cause is unsafe handling of symbolic links with effectively empty names during .tar and .tar.gz extraction on the controller, permitting writes to sensitive paths such as JENKINS_HOME/init.groovy.d/ (Groovy init scripts) or JENKINS_HOME/plugins/ (plugin deployment). No public exploit or CISA KEV listing has been identified at time of analysis, but the agent-to-controller trust boundary is a well-established Jenkins attack surface with a history of critical exploitation.

Technical ContextAI

Jenkins operates on a controller-agent architecture where build agents communicate with the central controller via the Remoting library. Archives produced by or transferred through agent processes are extracted server-side on the controller. This vulnerability is a variant of the tar-slip class of path traversal flaws (analogous to CWE-22, Improper Limitation of a Pathname): by crafting a .tar or .tar.gz archive containing a symbolic link entry with an effectively empty name, the extraction logic on the controller fails to confine the resolved write path within the intended target directory. This allows the symlink to redirect file writes to arbitrary filesystem locations, bounded only by the OS-level permissions of the Jenkins process user. No CPE strings were provided in input data; affected releases are Jenkins weekly 2.575 and earlier and LTS 2.568.1 and earlier per vendor advisory.

RemediationAI

Upgrade Jenkins to version 2.576 (weekly channel) or Jenkins LTS 2.568.2 or later; both are confirmed fix releases per the vendor advisory at https://www.jenkins.io/security/advisory/2026-08-05/. If immediate upgrade is not feasible, restrict Agent/Connect permissions to only fully trusted, internally managed agent infrastructure and avoid connecting agents that process untrusted third-party artifacts or run user-submitted build scripts. As a compensating control, run Jenkins as a dedicated low-privilege OS user with a tightly scoped home directory to limit the blast radius of arbitrary file writes - note this does not prevent exploitation but constrains the paths an attacker can write to. Auditing JENKINS_HOME/init.groovy.d/ and JENKINS_HOME/plugins/ for unexpected files should be incorporated into incident detection until patching is complete.