CVE-2026-70426 Deserialization in Jenkins
Attackers with agent access can bypass deserialization filters to execute arbitrary code on the Jenkins controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70426?
CVE-2026-70426 is a critical unsafe deserialization vulnerability in Jenkins, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.
Weakness: CWE-502
Which versions are affected by CVE-2026-70426?
1 open source package ship an affected version, including jenkins.
| Package | Affected | Fixed in |
|---|---|---|
jenkins Bitnami | All versions | 2.568.2, 2.576.0 |
How do I fix CVE-2026-70426?
Upgrade jenkins to a fixed version for your release line: 2.568.2 or 2.576.0.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-70426 being exploited?
There is no known exploitation of CVE-2026-70426 in the wild and no public exploit code.
Sources
Also known as BIT-jenkins-2026-70426, GHSA-v269-8r2r-vj93, MINI-32q3-hp89-j69x, MINI-4274-4mr9-4vv7, MINI-47x5-49xh-w8m4, MINI-cwpc-pwgj-753f and 4 more.