Jenkins Project · Jenkins
A deserialization flaw in Jenkins core and its plugins (Jenkins 2.567 and earlier, LTS 2.555.2 and earlier) lets attackers have arbitrary types deserialized from a crafted config.xml submission. An attacker with low-privilege authenticated access, and no user interaction, can use this to impersonate other users and send requests on their behalf, potentially running Script Console code or reading arbitrary files from the Jenkins controller.
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
First seen exploited 5 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.jenkins-ci.main:jenkins-core.
Upgrade to 2.568 or later
Set the version to 2.568 or later in your pom.xml or build.gradle.
The first fix for CVE-2026-53435.
| If you run | Upgrade to |
|---|---|
| 2.556 up to 2.568 | 2.568 |
| All versions before 2.555.3 | 2.555.3 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.