{"id":"CVE-2026-70426","aliases":["BIT-jenkins-2026-70426","EUVD-2026-53569","GHSA-v269-8r2r-vj93"],"status":"published","title":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00515,"percentile":0.44149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-08-05T17:40:27Z","modified":"2026-08-31T19:34:59Z","fixes":[{"ecosystem":"Bitnami","package":"jenkins","fixed_in":["2.568.2","2.576.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"jenkins","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.568.2"},{"introduced":"2.569.0"},{"fixed":"2.576.0"}]}]}],"products":[{"vendor":"jenkins project","product":"jenkins"},{"vendor":"jenkins project","product":"remoting"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911","tags":["vendor-advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70426","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v269-8r2r-vj93"}],"sources":{"cve":[{"id":"CVE-2026-70426","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","status":"published","published":"2026-08-05T17:40:27.071Z","modified":"2026-08-06T03:55:46.082Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:35:33.380441Z"}],"euvd":[{"id":"EUVD-2026-53569","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","status":"published","published":"2026-08-05T17:40:27Z","modified":"2026-08-06T03:55:46Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-v269-8r2r-vj93","title":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","status":"published","published":"2026-08-05T18:31:40Z","modified":"2026-08-05T21:32:44Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:10:08.59251Z"}],"nvd":[{"id":"CVE-2026-70426","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","status":"published","published":"2026-08-05T18:17:12.233Z","modified":"2026-08-31T19:34:59.477Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"BIT-jenkins-2026-70426","description":"In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.","status":"published","published":"2026-08-17T05:44:37.261Z","modified":"2026-08-17T08:01:33.946715517Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}