Jenkins Performance Plugin
Monthly
Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise.
Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise.