CVE-2026-70426 Details

A vulnerability exists in the Jenkins Remoting library versions 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, which are included in Jenkins 2.575 and earlier, as well as LTS 2.568.1 and earlier. The issue arises because the JEP-200 class filter is not applied to classes resolved via a fallback path during deserialization. This oversight allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath, potentially leading to code execution on the Jenkins controller.

Users can update to Jenkins version 2.576 or LTS 2.568.2, both of which apply the JEP-200 class filter to the fallback code path in the Remoting deserialization implementation. If an immediate update is not possible, a workaround is available. Details can be found in the GitHub repository dedicated to this vulnerability.