CVE-2026-42521 Details
Description
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
A vulnerability exists in the Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9, inclusive. The plugin improperly handles deserialization of inheritance strategies by invoking parameterless constructors of specified classes without restrictions. This flaw enables attackers with Item/Configure permission to instantiate arbitrary classes, potentially leading to information disclosure or other impacts based on the classes available on the classpath.
Users of the Matrix Authorization Strategy Plugin should update to version 3.2.10, which includes a fix for this vulnerability by ensuring that only valid inheritance strategy implementations can be instantiated.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3676 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins matrix authorization strategy | >= 2.1, < 3.2.10 2.0 beta1 2.0 beta2 2.0 beta3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | New CVE Received | [email protected] |