CVE-2026-70426: Jenkins Remoting Auth Bypass Vulnerability

CVE-2026-70426 Overview

CVE-2026-70426 is a deserialization filter bypass in Jenkins Remoting. The JEP-200 class filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. This allows agent processes, code running on agents, and attackers holding Agent/Connect permission to bypass the filter for classes on the Jenkins core classpath. The flaw is tracked as [CWE-502] Deserialization of Untrusted Data. Affected versions include Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987), bundled with Jenkins 2.575 and earlier and Jenkins LTS 2.568.1 and earlier.

Critical Impact
Attackers who can connect as a Jenkins agent, or who control code running on an agent, can bypass JEP-200 and reach gadget classes on the Jenkins core classpath, enabling remote code execution against the Jenkins controller.

Affected Products

Jenkins Remoting 3384.v60d89463d9e0 and earlier (except 3355.3357.v931d3c992987)
Jenkins weekly 2.575 and earlier
Jenkins LTS 2.568.1 and earlier

Discovery Timeline

2026-08-05 - Jenkins publishes Security Advisory SECURITY-3911
2026-08-05 - CVE-2026-70426 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-70426

Vulnerability Analysis

Jenkins Remoting handles communication between the Jenkins controller and its build agents. Java objects are serialized across this channel and reconstructed on the other side. To prevent gadget-chain attacks, Jenkins enforces JEP-200, a class allowlist applied during deserialization.

The Remoting deserialization implementation contains a fallback code path for resolving classes. This fallback path does not consult the JEP-200 class filter. Any class present on the Jenkins core classpath can be resolved and deserialized through this route without allowlist enforcement.

The bypass is reachable from three attacker positions: an agent process communicating with the controller, code executing within a build on an agent, and any authenticated user holding the Agent/Connect permission. Successful exploitation typically results in remote code execution on the Jenkins controller through a deserialization gadget chain drawn from core classes.

Root Cause

The root cause is inconsistent enforcement of the JEP-200 deserialization filter. The primary class-resolution path applies the filter, but a fallback resolution path bypasses it entirely. Any gadget class shipped on the Jenkins core classpath becomes reachable during deserialization once the fallback path is triggered.

Attack Vector

The attack vector is network-based. An attacker connects a controlled agent to the Jenkins controller, or executes code inside an existing build on an agent, or authenticates with Agent/Connect permission. The attacker then sends a crafted serialized payload that triggers the fallback resolution path. Consult the Jenkins Security Advisory #SECURITY-3911 for technical specifics.

No verified public proof-of-concept is available. See the security advisory for authoritative technical details.

Detection Methods for CVE-2026-70426

Indicators of Compromise

Unexpected agent connections from unknown hostnames or IP ranges targeting the Jenkins controller port (default 50000) or JNLP endpoints.
java.io.ObjectInputStream or Remoting deserialization exceptions in $JENKINS_HOME/logs referencing classes outside typical build workflows.
Java processes spawned from the Jenkins controller executing shell interpreters, curl, wget, or powershell without a matching pipeline step.
Outbound network connections from the Jenkins controller JVM to unfamiliar destinations shortly after an agent handshake.

Detection Strategies

Audit Jenkins authorization to identify all users and API tokens granted Agent/Connect permission and correlate against expected agent identities.
Enable Jenkins access logs and forward controller and agent logs to a centralized SIEM for retention and search.
Alert on child processes of the Jenkins controller JVM (java -jar jenkins.war) that are not part of standard build orchestration.
Baseline outbound network activity from the controller host and flag deviations following agent connection events.

Monitoring Recommendations

Ingest Jenkins controller and agent logs into a centralized data lake and retain them for post-incident analysis.
Monitor for creation of new agent nodes and administrative configuration changes via the Jenkins audit trail.
Track process lineage on the controller host to detect deserialization-driven code execution patterns.

How to Mitigate CVE-2026-70426

Immediate Actions Required

Upgrade Jenkins Remoting to a fixed release and update the Jenkins weekly line beyond 2.575 or the LTS line beyond 2.568.1 per the vendor advisory.
Restrict the Agent/Connect permission to service accounts that actually operate build agents; remove it from general users.
Isolate the Jenkins controller network segment so that only authorized agent hosts can reach the agent listener port.
Rotate agent secrets and API tokens after patching, especially in environments where agent identities may have been shared.

Patch Information

Apply the fixes documented in the Jenkins Security Advisory #SECURITY-3911. The advisory lists the specific Remoting, Jenkins weekly, and Jenkins LTS versions that resolve the fallback path filter bypass.

Workarounds

If immediate patching is not possible, disable inbound agent connections and use only outbound-initiated, controller-launched agents from trusted hosts.
Remove Agent/Connect permission from all non-essential principals until the upgrade is completed.
Place the Jenkins controller behind network access controls that restrict agent listener exposure to known agent subnets.

bash

# Example: enumerate principals with Agent/Connect via Jenkins Script Console
# Run at /script on the Jenkins controller (administrator only)
import jenkins.model.Jenkins
import hudson.security.Permission

def strategy = Jenkins.get().getAuthorizationStrategy()
println strategy.getClass().getName()
// Review Manage Jenkins > Security > Authorization for sids holding
// hudson.model.Computer.Connect (Agent/Connect) and remove where unneeded.