Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers malicious tar extraction via POST /job/{name}/build, writing persistent symlinks into the Jenkins tool cache. Symlinks to secrets/master.key and credentials.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all stored credentials and admin RCE. Symlinks to /dev/zero or blocking FIFOs hang build executors.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Jenkins Project | Jenkins | affected | — |
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Jenkins Project
Subscribe
|
Jenkins
Subscribe
|
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 10 Aug 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/{name}/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Files are read via GET /job/{name}/lastBuild/consoleText. These three files enable offline AES decryption of all stored Jenkins credentials, escalating to admin access and RCE. | Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers malicious tar extraction via POST /job/{name}/build, writing persistent symlinks into the Jenkins tool cache. Symlinks to secrets/master.key and credentials.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all stored credentials and admin RCE. Symlinks to /dev/zero or blocking FIFOs hang build executors. |
| Metrics |
cvssV3_1
|
cvssV3_1
|
Mon, 10 Aug 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing the CVE-2026-33001 fix. An admin points a tool installer (DownloadFromUrlInstaller/ZipExtractionInstaller) at an attacker URL; any user's POST /job/{name}/build then extracts the malicious tar, planting symlinks in the tool cache. Sensitive files are read via GET /job/{name}/lastBuild/consoleText or GET /job/{name}/ws/{file}, exposing /etc/passwd, secrets/master.key, and credentials.xml. | Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/{name}/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and credentials.xml. Files are read via GET /job/{name}/lastBuild/consoleText. These three files enable offline AES decryption of all stored Jenkins credentials, escalating to admin access and RCE. |
Mon, 10 Aug 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files. | Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing the CVE-2026-33001 fix. An admin points a tool installer (DownloadFromUrlInstaller/ZipExtractionInstaller) at an attacker URL; any user's POST /job/{name}/build then extracts the malicious tar, planting symlinks in the tool cache. Sensitive files are read via GET /job/{name}/lastBuild/consoleText or GET /job/{name}/ws/{file}, exposing /etc/passwd, secrets/master.key, and credentials.xml. |
| First Time appeared |
Jenkins Project
Jenkins Project jenkins |
|
| Vendors & Products |
Jenkins Project
Jenkins Project jenkins |
Mon, 10 Aug 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files. | |
| Title | Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read | |
| Weaknesses | CWE-59 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published:
Updated: 2026-08-10T14:54:36.472Z
Reserved: 2026-08-10T12:06:37.123Z
Link: CVE-2026-19429
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-10T13:30:05Z
Weaknesses