CVE-2026-19429: Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read
An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.
Other sources
Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/{name}/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Files are read via GET /job/{name}/lastBuild/consoleText. These three files enable offline AES decryption of all stored Jenkins credentials, escalating to admin access and RCE.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Project Jenkinsto a version that resolves this vulnerability.Fixed in 2.555.3 - Compensating control
Restrict access so only trusted users can have Item/Configure permission (and Item/Build if applicable), because authenticated attackers with Item/Configure can read arbitrary files via crafted tar archives and Item/Build users can trigger malicious tar extraction via POST /job/{name}/build.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19429?
The severity of CVE-2026-19429 is classified as medium with a score of 6.5.
How do I fix CVE-2026-19429?
To fix CVE-2026-19429, update Jenkins to a version that includes the complete patch for this vulnerability.
What type of access is required to exploit CVE-2026-19429?
An authenticated remote attacker with Item/Configure permission is required to exploit CVE-2026-19429.
What can an attacker do with CVE-2026-19429?
An attacker can read arbitrary files on the Jenkins controller filesystem using a crafted tar archive.
Which versions of Jenkins are affected by CVE-2026-19429?
CVE-2026-19429 affects Jenkins through LTS version 2.555.3.