CVE-2026-70427: Jenkins Path Traversal Vulnerability

CVE-2026-70427 Overview

CVE-2026-70427 affects Jenkins versions 2.575 and earlier, and LTS 2.568.1 and earlier. The vulnerability stems from unsafe handling of symbolic links with effectively empty names during extraction of .tar and .tar.gz archives. An attacker who controls an agent process can supply a crafted archive to the Jenkins controller. The controller then writes files to arbitrary locations on the file system, bounded only by the file system permissions of the Jenkins user. This weakness maps to CWE-59: Improper Link Resolution Before File Access.

Critical Impact
An attacker controlling a Jenkins agent can write arbitrary files to the controller file system, enabling tampering with Jenkins configuration, plugins, or build artifacts.

Affected Products

Jenkins weekly releases 2.575 and earlier
Jenkins LTS releases 2.568.1 and earlier
Jenkins controller instances receiving archives from attacker-controlled agents

Discovery Timeline

2026-08-05 - CVE-2026-70427 published to NVD by Jenkins project via Security Advisory SECURITY-3930
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70427

Vulnerability Analysis

Jenkins controllers routinely receive archive data from agents during build and artifact transfer operations. The extraction logic for .tar and .tar.gz archives fails to validate symbolic link entries whose names resolve to effectively empty strings. When such entries are processed, the extractor follows the symlink target during subsequent file writes rather than treating the entry as inert. An attacker who controls an agent process crafts an archive containing these malformed symlink entries. The controller writes subsequent archive contents through the symlink to attacker-chosen paths on the controller host. Impact scope depends on the operating system account running Jenkins, which frequently has broad access to Jenkins home directories, plugin directories, and build workspaces.

Root Cause

The underlying flaw is improper link resolution before file access [CWE-59]. The archive extraction routine trusts symlink metadata within untrusted tar streams. Empty-name symlink entries bypass path sanitization checks that are applied to normal file entries. This behavior is consistent with a class of tar extraction issues where symbolic links are created before subsequent entries are written, allowing later writes to be redirected outside the intended extraction directory.

Attack Vector

Exploitation requires an attacker to control a Jenkins agent process that communicates with the controller. Agent-to-controller archive transfers occur during common CI operations such as returning workspace archives. The attacker crafts a .tar or .tar.gz file containing a symlink entry with an effectively empty name that points to a sensitive directory. When the controller extracts the archive, subsequent file entries traverse the symlink and land at arbitrary file system locations writable by the Jenkins process user. Refer to the Jenkins Security Advisory SECURITY-3930 for authoritative technical details.

Detection Methods for CVE-2026-70427

Indicators of Compromise

Unexpected file writes under the Jenkins home directory, plugins/, or war/ directories that are not tied to a plugin install or upgrade event
Presence of symbolic links with empty or whitespace-only names inside archives transferred from agents
Modification timestamps on Jenkins configuration files (config.xml, credentials.xml) that do not correspond to administrator actions

Detection Strategies

Inspect archive payloads captured on the controller for tar entries of type symlink (typeflag=2) with zero-length or whitespace-only names
Audit Jenkins controller file system for writes originating from the Jenkins process to paths outside expected workspace and build directories
Correlate agent connection events with subsequent unexpected file changes on the controller host

Monitoring Recommendations

Enable file integrity monitoring on JENKINS_HOME, plugin directories, and system paths writable by the Jenkins user
Log and retain agent-to-controller archive transfers for forensic review
Alert on creation of symbolic links by the Jenkins process outside expected build workspaces

How to Mitigate CVE-2026-70427

Immediate Actions Required

Upgrade Jenkins weekly to version 2.576 or later, and Jenkins LTS to 2.568.2 or later, per the Jenkins Security Advisory
Restrict which principals can connect agents to the controller and revoke agent credentials that are not strictly required
Review recent controller file system changes for signs of unauthorized writes originating from agent archive extraction

Patch Information

Jenkins has published fixed releases in Security Advisory SECURITY-3930. Administrators should apply the patched weekly or LTS release that addresses the unsafe symlink handling in tar extraction. No configuration change on its own eliminates the flaw; upgrading is the authoritative remediation.

Workarounds

Run the Jenkins controller under a dedicated low-privilege operating system account with file system access limited to Jenkins-managed directories
Isolate the controller from agents that process untrusted code by segmenting builds onto ephemeral, tightly scoped agents
Where feasible, avoid returning archived artifacts from untrusted agents to the controller until patching is complete

bash

# Verify installed Jenkins version and confirm patched release
java -jar jenkins.war --version

# Example: run Jenkins under a dedicated non-root user with a restricted JENKINS_HOME
sudo useradd -r -m -d /var/lib/jenkins -s /usr/sbin/nologin jenkins
sudo chown -R jenkins:jenkins /var/lib/jenkins
sudo chmod 750 /var/lib/jenkins