CVE-2026-84670 in Performance Plugin
Summary
by MITRE • 09/02/2026
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as CVE-2023-5476 represents a critical security flaw within the Performance Plugin for Jenkins, specifically affecting versions 1015.v09ca_52b_3370e and earlier. This issue stems from an insecure deserialization mechanism that fails to properly validate or restrict the classes allowed during the reconstruction of cached performance reports stored in the build directory on the Jenkins controller. In Java-based applications, object serialization is a common technique used to persist state by converting objects into byte streams for storage or transmission. However, when these streams are read back and deserialized, the system must instantiate specific class types corresponding to the serialized data. If this process lacks strict whitelisting of allowed classes, it creates an opportunity for attackers to inject malicious payloads that exploit trusted libraries within the application environment.
The technical root cause lies in the absence of a robust allowlist mechanism during the deserialization phase. When Jenkins processes cached performance reports, it relies on reflection and dynamic class loading to reconstruct Java objects from their serialized forms. Without explicit constraints on which classes can be instantiated, an attacker who has gained Item or Configure permission within a Jenkins project can manipulate these report files. By crafting a specially designed serialized object containing malicious code, such as gadgets derived from common libraries like Commons Collections or Spring Framework, the attacker forces the Jenkins controller to execute arbitrary commands during the deserialization process. This bypasses standard authentication and authorization checks because the exploit leverages legitimate administrative functions that require only Item or Configure permissions rather than full system administration rights.
The operational impact of this vulnerability is severe, as it effectively allows for Remote Code Execution on the Jenkins controller with low privilege requirements. An attacker does not need to compromise a high-level administrator account; instead, access limited to configuring specific jobs or items within a project is sufficient to trigger the exploit. Once executed, the arbitrary code runs under the context of the user account operating the Jenkins server, which often possesses significant privileges including file system access and network connectivity. This can lead to complete compromise of the CI/CD infrastructure, enabling further lateral movement into internal networks, theft of sensitive source code or credentials stored in build artifacts, and disruption of software delivery pipelines. The persistence of cached reports makes this vulnerability particularly dangerous as it may be triggered automatically during routine job executions without requiring immediate manual intervention by an administrator to notice the anomaly.
From a classification perspective, this flaw aligns with CWE-502 Deserialization of Untrusted Data, which highlights the risks associated with accepting serialized objects from unverified sources without proper validation. Additionally, the exploitation technique maps directly to MITRE ATT&CK tactic T1059 Command and Scripting Interpreter through subtechniques involving Java-based execution vectors such as T1620 Reflection-Based Evasion or general remote code execution patterns found in enterprise environments like Jenkins. The vulnerability underscores the importance of implementing strict input validation and adhering to secure coding practices that prevent arbitrary object instantiation during deserialization processes.
To mitigate this risk, organizations must immediately upgrade the Performance Plugin to version 1015.v09ca_52b_3370e or later where these restrictions have been implemented. In environments where immediate patching is not feasible, administrators should consider restricting Item and Configure permissions for untrusted users until the update can be applied. Furthermore, deploying network-level controls to limit outbound connections from Jenkins controllers can help reduce the blast radius in case of a successful compromise. It is also advisable to audit existing build directories for any suspiciously modified report files that may indicate prior exploitation attempts. Regular security assessments and adherence to OWASP guidelines on serialization vulnerabilities are essential components of maintaining a resilient CI/CD pipeline infrastructure against such deserialization attacks.