CVE-2026-53435

HIGH

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-53435 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC and 2 lab environments.

Description

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 15, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Lab environments
2

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 10, 2026 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

jenkins

Browse Jenkins / jenkins
VulnCheckVersion data not supplied

Jenkins

Browse Jenkins Project / Jenkins

Default status: affected

CVE List2.568 to < *unaffected
2.555.3 to < 2.555.*unaffected

OpenShift Developer Tools and Services

Browse Red Hat / OpenShift Developer Tools and Servicesjenkins

Default status: affected

CVE ListVersion data not supplied

org.jenkins-ci.main:jenkins-core

Browse Maven / org.jenkins-ci.main:jenkins-core
GitHub AdvisoryBefore 2.555.3 · Fixed in 2.555.3affected
2.556 to < 2.568 · Fixed in 2.568affected

Proofs of concept

1

Repository PoCs

GitHubAmesianX/CVE-2026-53435Repository PoCby AmesianX11Exploit10 files

903.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-53435 that plants a Jenkins core gadget (hudson.Plugin$DummyImpl) into a ListView's config.xml via an authenticated HTTP POST, then triggers arbitrary file read from the controller's filesystem by routing an HTTP GET request to the deserialized object.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README.md and an exploit script (exploit_cve_2026_53435_v2.py) for CVE-2026-53435. The script performs only the documented exploit behavior: authenticating to a Jenkins instance, planting a crafted config.xml containing a Jenkins-core gadget (hudson.Plugin$DummyImpl with baseResourceURL=file:/) into a ListView's properties, and then triggering an HTTP GET to read an arbitrary file from the controller's filesystem. No concealed backdoor, credential exfiltration, persistence mechanism, or unrelated payload is present. The script's network activity is limited to the target Jenkins instance specified by the user, and all operations are consistent with the stated proof-of-concept for the CVE.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespythonmarkdown
Target softwareJenkins
Attack typesdeserializationarbitrary file read
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script exploit_cve_2026_53435_v2.py actively exercises the vulnerability by sending crafted HTTP requests to plant a deserialization gadget and then trigger arbitrary file read. This is code intended to exploit a vulnerability, not merely detect or report it.

exploit_cve_2026_53435_v2.py:1-84

Requirements

  • Requires a Jenkins account with View/Configure permission to POST a view config.xml, plus Overall/Read.README.md:113-114
  • Target must be a vulnerable Jenkins version (weekly ≤ 2.567, LTS ≤ 2.555.2).README.md:18

Observed behavior

  • Authenticates to Jenkins using HTTP Basic Auth and fetches a CSRF crumb.exploit_cve_2026_53435_v2.py:42-50
  • Creates a new ListView or overwrites an existing view's config.xml with a payload containing a hudson.Plugin_-DummyImpl gadget with baseResourceURL=file:/.exploit_cve_2026_53435_v2.py:25-34exploit_cve_2026_53435_v2.py:57-74
  • Sends an HTTP GET request to the planted gadget's Stapler route, reading an arbitrary file from the controller's filesystem and printing its contents.exploit_cve_2026_53435_v2.py:77-81
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe script authenticates to a user-supplied Jenkins instance, plants a crafted config.xml, and reads a specified file. This matches the documented CVE-2026-53435 impact.exploit_cve_2026_53435_v2.py:25-27exploit_cve_2026_53435_v2.py:57-58exploit_cve_2026_53435_v2.py:78-81
Target Scope
Payload withheldAll network operations are directed exclusively at the target provided by the user. No hardcoded external endpoints or data exfiltration channels exist.exploit_cve_2026_53435_v2.py:39-42exploit_cve_2026_53435_v2.py:57exploit_cve_2026_53435_v2.py:78
Disclosure
Payload withheldThe author explicitly notes that more impactful exploit chains were reached but are not included in this public PoC, limiting the artifact to file read only.README.md:69-74
Review boundaries

What the analysis did not establish

  • Only two of ten repository files were provided as text; the remaining eight files (including lab/ and transcript/ directories) were omitted.
  • The evidence includes a non-text media file (poc.png) that was not analyzed.
  • The artifact's README states that user impersonation and Script Console RCE chains were intentionally withheld, so the exploit only demonstrates file read.
  • 7 text files and 1 non-text media file (poc.png) from the repository were not included in the evidence packet and were not reviewed. The verdict applies only to the reviewed README.md and exploit_cve_2026_53435_v2.py files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

lab

AmesianX/CVE-2026-53435Created Vuln labCVE-2026-53435Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based lab for reproducing and demonstrating the Jenkins deserialization vulnerability CVE-2026-53435. It includes a vulnerable Jenkins LTS 2.555.2 target, a patched Jenkins LTS 2.555.3 negative control, and an OOB callback listener. A low-privilege attacker account is provisioned via init.groovy.d script.

lab/README.md:1-7lab/Dockerfile:1-10lab/init.groovy.d/01-setup.groovy:1-38

Lab assessment

Vulnerability lab

The README explicitly states the lab is for reproducing and demonstrating CVE-2026-53435, a Jenkins deserialization vulnerability. The Dockerfile builds a vulnerable Jenkins image with matrix-auth plugin, and the init.groovy.d script provisions a low-privilege attacker account matching the documented prerequisite. The topology includes a vulnerable target, a patched control, and an OOB listener, all consistent with a vulnerability research environment.

lab/README.md:1-7lab/Dockerfile:1-10lab/init.groovy.d/01-setup.groovy:1-38
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

cve53435-jenkins-vuln

vulnerable target

Jenkins LTS 2.555.2 container with matrix-auth plugin, serving as the vulnerable target for the CVE-2026-53435 exploit. The setup wizard is skipped, and a low-privilege user is provisioned via init.groovy.d.

lab/README.md:10-12lab/Dockerfile:1-10

cve53435-jenkins-fixed

patched negative control

Jenkins LTS 2.555.3 container, used as a negative control to demonstrate that the patch prevents the exploit.

lab/README.md:10-12

cve53435-oob

OOB callback listener

A listener container that receives out-of-band callbacks from the vulnerable Jenkins instance, proving server-side request forgery (SSRF) or deserialization primitive.

lab/README.md:10-12

lowpriv user

low-privilege attacker account

A Jenkins user with Overall/Read and Item/Configure permissions, created by the init.groovy.d script to model the documented attack prerequisite.

lab/init.groovy.d/01-setup.groovy:1-38lab/README.md:14-16

poc_cve_2026_53435.py

exploit script

A Python script referenced in the README for triaging, canary OOB proof, and gadget discovery. It is not included in the evidence files, so its behavior is only known from the README description.

lab/README.md:28-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-53435

Supported by supplied evidence

The README explicitly associates the lab with CVE-2026-53435, describing it as a Jenkins core deserialization vulnerability (SECURITY-3707). The Dockerfile builds a vulnerable Jenkins version (2.555.2-lts) and the init.groovy.d script sets up the exact low-privilege prerequisite mentioned in the README. The lab topology includes a patched version for negative control, consistent with a CVE reproduction environment.

lab/README.md:1-7lab/Dockerfile:1-10lab/init.groovy.d/01-setup.groovy:1-38
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.lab/README.md:20-21
  • Python 3 environment to run the PoC script.lab/README.md:28-30
  • The PoC script poc_cve_2026_53435.py must be present (not included in evidence).lab/README.md:28-30
  • A candidate list file lab/candidates.txt for gadget discovery (not included in evidence).lab/README.md:60-63

Evidence-described exercise path

  1. Bring up the lab using docker compose, wait for Jenkins to boot, and verify HTTP 200 on the vulnerable instance.lab/README.md:20-24
  2. Run triage mode to confirm the vulnerable instance is detected as VULNERABLE and the patched instance as patched.lab/README.md:28-30
  3. Execute the canary mode with low-privilege credentials to trigger an OOB callback, proving the deserialization primitive without RCE.lab/README.md:36-42
  4. Check the OOB listener logs for the marker to confirm the callback.lab/README.md:44-46
  5. Run discovery mode to find a working gadget on the target's classpath by sweeping candidates and correlating OOB markers.lab/README.md:60-68
  6. Repeat steps 3-4 against the patched instance to demonstrate the attack is rejected, providing negative control evidence.lab/README.md:72-75
  7. Optionally, weaponize the confirmed gadget to achieve Script Console RCE or file read within the lab only.lab/README.md:79-83
  8. Tear down the lab with docker compose down -v.lab/README.md:87-89
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All described behavior targets the local lab containers (vulnerable Jenkins, patched Jenkins, OOB listener). The README explicitly states the lab is self-contained and for authorized testing only. The Dockerfile only installs a plugin and sets an environment variable; the init.groovy.d script only creates local users and permissions. No evidence of host escape, external connections, persistence, credential theft, or destructive actions outside the lab.

lab/README.md:3-7lab/Dockerfile:1-10lab/init.groovy.d/01-setup.groovy:1-38
Review boundaries

What the analysis did not establish

  • The docker-compose.yml file is not included in the evidence, so the full service definitions, network configuration, and port mappings are unknown.
  • The PoC script poc_cve_2026_53435.py is not included, so its exact behavior and safety cannot be verified.
  • The candidate list lab/candidates.txt is not included, so the gadget discovery process cannot be fully assessed.
  • The lab relies on an external base image jenkins/jenkins:2.555.2-lts, which is not inspected.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

lab/docker-compose.yml

AmesianX/CVE-2026-53435Created Vuln labCVE-2026-53435Compose · images

1 Compose manifest · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for demonstrating CVE-2026-53435, a Jenkins deserialization vulnerability. It includes a vulnerable Jenkins LTS 2.555.2 instance, a patched Jenkins LTS 2.555.3 instance as a negative control, and an out-of-band (OOB) HTTP listener to prove server-side request forgery from a low-privileged user.

lab/docker-compose.yml:1-49lab/README.md:1-107

Lab assessment

Vulnerability lab

The README explicitly states the lab is for reproducing and demonstrating CVE-2026-53435, a Jenkins core deserialization vulnerability. The Compose file provisions a vulnerable target, a patched control, and an OOB listener, all consistent with a vulnerability research exercise.

lab/README.md:1-4lab/docker-compose.yml:1-6
Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

jenkins-vuln

vulnerable target

Jenkins LTS 2.555.2 container, the vulnerable target for the CVE. It exposes port 8080, disables the setup wizard, and mounts a Groovy init script to provision a low-privileged user.

lab/docker-compose.yml:12-22

jenkins-fixed

patched control

Jenkins LTS 2.555.3 container, the patched version used as a negative control. It exposes port 8081 and uses the same init script to provision the same low-privileged user.

lab/docker-compose.yml:25-34

oob-listener

out-of-band callback listener

A Python HTTP server on port 9000 that logs all incoming requests, used to prove that a server-side request was triggered by the exploit payload.

lab/docker-compose.yml:38-43

init.groovy.d/01-setup.groovy

lab provisioning script

A Groovy init script that creates two users (admin and lowpriv) and configures project-based matrix authorization. The lowpriv user has Overall/Read and Item/Configure permissions, matching the documented attack prerequisite.

lab/init.groovy.d/01-setup.groovy:1-38
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-53435

Supported by supplied evidence

The lab is explicitly named and documented for CVE-2026-53435. The README describes the vulnerability, the vulnerable version (2.555.2), the patched version (2.555.3), and the low-privilege attack path. The Compose file and init script implement the exact prerequisites.

lab/README.md:1-4lab/docker-compose.yml:1-6lab/init.groovy.d/01-setup.groovy:1-4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed to run the lab.lab/README.md:20-21
  • A low-privileged Jenkins user with Overall/Read and Item/Configure permissions, provisioned by the init script.lab/init.groovy.d/01-setup.groovy:1-4lab/init.groovy.d/01-setup.groovy:28-33
  • The PoC script (poc_cve_2026_53435.py) must be available to execute the attack steps.lab/README.md:30-31

Evidence-described exercise path

  1. Bring up the lab with 'docker compose -f lab/docker-compose.yml up -d' and wait for Jenkins to boot.lab/README.md:20-24
  2. Run triage mode to confirm the vulnerable instance is detected and the patched instance is not.lab/README.md:28-31
  3. Execute the canary mode with low-privilege credentials and an OOB listener to prove the deserialization primitive triggers a server-side request.lab/README.md:35-44
  4. Run discovery mode to find a working gadget on the target's classpath by sweeping candidates.lab/README.md:48-60
  5. Repeat steps 3-4 against the patched instance to demonstrate the fix blocks the attack.lab/README.md:64-67
  6. Optionally weaponize the confirmed gadget to achieve RCE or file read within the lab only.lab/README.md:71-76
  7. Tear down the lab with 'docker compose -f lab/docker-compose.yml down -v'.lab/README.md:80-82
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own containers. The Compose file uses standard port mappings, a bind mount for the init script, and a bridge network. No privileged mode, host filesystem access beyond the lab directory, or external network connections are configured. The README explicitly states the lab is self-contained and for authorized testing only.

lab/docker-compose.yml:1-49lab/README.md:1-7
Review boundaries

What the analysis did not establish

  • The PoC script (poc_cve_2026_53435.py) is not included in the evidence packet, so its exact behavior cannot be analyzed.
  • The candidates.txt file is listed in the file inventory but its content is not provided, so the discovery sweep targets are unknown.
  • The Dockerfile in the lab directory is not included in the evidence files, so any custom image build steps are uninspected.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

8