Jenkins <=2.555.3 TAR Symlink PT - Arbitrary File Disclosure
CVE-2026-19429 Published on August 10, 2026
Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read
An incomplete patch for CVE-2026-33001 in Jenkins Project Jenkins through LTS 2.555.3 allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. The CVE-2026-33001 security update validates symlink destinations during tar extraction in FilePath.java but does not validate symlink targets; a symlink whose location is inside the workspace can still point to arbitrary paths outside it, enabling disclosure of any file readable by the Jenkins process user, including secrets/master.key, credentials.xml, and other sensitive configuration files.
Vulnerability Analysis
CVE-2026-19429 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Timeline
Vulnerability discovered via patch-diff analysis of CVE-2026-33001 fix
Re-verified against Jenkins LTS 2.555.3 — still unpatched 123 days later.
Public disclosure (90-day window exceeded) 5 days later.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-19429 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-19429
Want to know whenever a new CVE is published for Jenkins? stack.watch will email you.
