Which versions of Jenkins are affected by EUVD-2026-55615?

Jenkins LTS through 2.555.3 contains a critical arbitrary file-read vulnerability (CVSS 9.4) allowing authenticated users with Item/Configure permissions to exfiltrate sensitive configuration…

How to fix or mitigate EUVD-2026-55615?

Within 24 hours, restrict Item/Configure permission to administrators only and audit current permission assignments in Jenkins. Within 7 days, rotate all secrets stored in Jenkins including API tokens, cloud credentials, SSH keys, and stored passwords, treating them as potentially exposed. Within 30 days, monitor Jenkins vendor advisories for patched LTS versions and apply patches immediately upon availability; if patches are not released, evaluate long-term alternatives such as infrastructure isolation or transitioning to alternative CI/CD systems.

Jenkins EUVD-2026-55615

Q: What is the CVSS score of EUVD-2026-55615?

EUVD-2026-55615 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-19429 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-08-10 TuranSec

GHSA-83x3-qgq9-rfcq

Java Information Disclosure Jenkins Red Hat Jenkins Project

9.4

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and reliable given the crafted archive (AV:N/AC:L), but gated behind Item/Configure (PR:L); impact is arbitrary file read only, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 11, 2026 - 08:22 NVD

HIGH CRITICAL

CVSS changed

Aug 11, 2026 - 08:22 NVD

8.3 (HIGH) 9.4 (CRITICAL)

Severity Changed

Aug 10, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Aug 10, 2026 - 17:22 NVD

9.4 (CRITICAL) 8.3 (HIGH)

Analysis Updated

Aug 10, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

Aug 10, 2026 - 15:22 NVD

MEDIUM CRITICAL

CVSS changed

Aug 10, 2026 - 15:22 NVD

6.5 (MEDIUM) 9.4 (CRITICAL)

Analysis Generated

Aug 10, 2026 - 13:06 vuln.today

CVE Published

Aug 10, 2026 - 12:07 cve.org

MEDIUM 6.5

DescriptionCVE.org

An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.

Articles & Coverage 1

News Critical Arbitrary File Read in Jenkins LTS 2.555.3 - CVE-2026-19429 Aug 10, 2026

AnalysisAI

Arbitrary file read on the Jenkins controller affects Jenkins through LTS 2.555.3, where an authenticated attacker holding Item/Configure permission can exfiltrate any file readable by the Jenkins process user by uploading a crafted tar archive containing a symlink. This is an incomplete-fix bypass of CVE-2026-33001: the prior patch validated where a symlink is placed during extraction but not where it points, so a link staged inside the workspace can still resolve to paths outside it. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but it directly exposes secrets/master.key, credentials.xml, and other sensitive configuration.

Technical ContextAI

Jenkins is a Java-based automation/CI server whose controller manages jobs, credentials, and build workspaces. The defect lives in FilePath.java tar-extraction logic, which is exercised when archives are unpacked into a job workspace. CWE-59 (link following) is the root cause: the CVE-2026-33001 hardening checked that a symlink's on-disk destination stays within the workspace but did not validate the symlink's target path, so an extracted link located inside the workspace can reference arbitrary absolute paths (e.g. the Jenkins home directory). When Jenkins subsequently reads or archives that link's contents, it dereferences the pointer and returns out-of-tree file data. The affected component is identified by cpe:2.3:a:jenkins_project:jenkins:*:*:*:*:*:*:*:* and the issue is tracked as EUVD-2026-55615.

RemediationAI

Patch available per vendor advisory (https://www.jenkins.io/security/advisories/2026-03-19/) - upgrade to the fixed Jenkins LTS release published in that advisory once your maintenance window allows; an exact fixed version string was not included in the provided data, so confirm it directly from the advisory before deploying. As compensating controls until patched, tighten the authorization matrix so that Item/Configure is granted only to trusted users (this is the exploitation prerequisite; the trade-off is reduced self-service job editing), and avoid running jobs that extract untrusted tar archives on the controller - prefer running such workloads on agents rather than the built-in controller node (Jenkins' recommended 'don't build on the controller' posture), which limits the files an attacker's symlink can reach. Rotate secrets/master.key and any credentials in credentials.xml if you suspect the account population with Item/Configure was untrusted, since those are the primary disclosure targets.