Jenkins - Deserialization of Untrusted Data
Title source: ruleExploitation Summary
CVE-2026-53435 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including AmesianX.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-53435, a deserialization vulnerability in Jenkins. The exploit leverages a DescribableList gadget to achieve arbitrary file reads via a crafted config.xml submission, targeting either ListView creation or overwrite vectors.
Description
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
Exploits (1)
This repository contains a functional exploit for CVE-2026-53435, a deserialization vulnerability in Jenkins. The exploit leverages a DescribableList gadget to achieve arbitrary file reads via a crafted config.xml submission, targeting either ListView creation or overwrite vectors.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H