CVE-2026-42521 Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Attackers with configure permissions can instantiate arbitrary classes via unsafe deserialization, potentially leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42521?
CVE-2026-42521 is a medium-severity unsafe deserialization vulnerability in Jenkins Matrix Authorization Strategy Plugin, published on 29 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Weakness: CWE-502
Which versions are affected by CVE-2026-42521?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:matrix-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:matrix-auth Maven | From 2.0-beta-1 | 3.2.10 |
org.jenkins-ci.plugins:matrix-auth Maven | From 2.0-beta-1 | 3.2.10 |
Products include Jenkins Matrix Authorization Strategy.
How do I fix CVE-2026-42521?
Upgrade org.jenkins-ci.plugins:matrix-auth to 3.2.10 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-42521 being exploited?
There is no known exploitation of CVE-2026-42521 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Matrix Authorization Strategy Plugin
Sources
Also known as GHSA-jp9r-mmhw-vff3, MINI-296j-xcj5-c6fx, MINI-48r4-8gfg-hrv3, MINI-8jp9-r8p3-7c27, MINI-vmw5-xhj6-w276, MINI-w3rq-69qj-f5j9 and 2 more.