CVE-2026-19429 in Jenkins
Summary
by MITRE • 08/10/2026
An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical security flaw in the Jenkins continuous integration platform that emerged from an incomplete security patch addressing CVE-2026-33001. The issue affects Jenkins versions through LTS 2.555.3 and demonstrates how partial remediation can leave systems exposed to sophisticated attacks. The vulnerability specifically targets the tar extraction functionality within Jenkins' FilePath.java component, where the original patch attempted to validate symlink destinations but failed to address the underlying target validation problem.
The technical flaw exploits a fundamental weakness in how Jenkins handles symbolic links during archive extraction processes. While the security update correctly identified that symlink destinations needed validation, it overlooked the critical aspect of validating the actual targets that these symlinks reference. This oversight creates a scenario where an attacker can craft a malicious tar archive containing a symlink that appears to be confined to the workspace directory but actually points to sensitive files outside of it. The vulnerability operates at the filesystem level and leverages the principle that symbolic links can bypass directory restrictions when their targets are not properly validated.
The operational impact of this vulnerability is severe and far-reaching for Jenkins administrators and security teams. An authenticated attacker with minimal permissions - specifically Item/Configure access - can leverage this flaw to extract sensitive information from the Jenkins controller's filesystem. The attack surface includes critical system files such as secrets/master.key which contains encryption keys, credentials.xml storing authentication credentials, and other configuration files that could compromise the entire Jenkins infrastructure. This vulnerability essentially transforms a limited permission level into a high-impact reconnaissance and data exfiltration capability.
This vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and represents a classic case of incomplete input validation where the fix addresses only part of the attack vector. The flaw also maps to ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) in scenarios where attackers can leverage compromised Jenkins credentials to escalate privileges through information disclosure. The vulnerability demonstrates how insufficient patching can create persistent security gaps that allow attackers to move laterally within systems and access sensitive configuration data that should remain protected.
Organizations should immediately implement mitigations including updating to patched Jenkins versions, implementing additional filesystem access controls, and monitoring for suspicious tar archive extraction activities. Network segmentation and privilege separation can help limit the impact if exploitation occurs. Additionally, regular security audits of Jenkins configurations and automated scanning for similar incomplete patch patterns should be implemented as part of comprehensive security operations. The vulnerability underscores the importance of thorough security testing and validation processes before deploying patches to production environments.