CVE-2026-70426: Jenkins Remoting deserialization filter bypass, agent-to-controller RCE

Critical 9.0 EPSS 0.5%

The Remoting library Jenkins uses between controller and agents did not apply the JEP-200 class filter to classes resolved through a fallback path during deserialization. An agent process, code running on an agent (for example a malicious build), or an attacker with Agent/Connect permission can bypass the filter for classes on the Jenkins core classpath, which could be used to execute code on the Jenkins controller. The Jenkins project rates it critical (SECURITY-3911).

• CVE-2026-70426CVE identifier
• 9.0CVSS 3.1 base score (critical)
• 0.5%EPSS: chance of exploitation in the next 30 days (higher than 44% of CVEs)
• 2026-08-05published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Jenkins weekly 2.575 and earlier
• Jenkins LTS 2.568.1 and earlier
• Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987

Fixed in:

• Jenkins weekly 2.576
• Jenkins LTS 2.568.2

Am I affected?

dpkg -l jenkins | grep ^ii; rpm -q jenkins
curl -sI https://jenkins.example.com/login | grep -i x-jenkins
docker ps --format '{{.Image}}' | grep jenkins/jenkins

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

# Jenkins APT repository (pkg.jenkins.io)
sudo apt-get update
sudo apt-get install --only-upgrade jenkins
sudo systemctl restart jenkins

sudo apt-get update
sudo apt-get install --only-upgrade jenkins
sudo systemctl restart jenkins

# Jenkins RPM repository (pkg.jenkins.io)
sudo dnf upgrade jenkins
sudo systemctl restart jenkins

docker pull jenkins/jenkins:2.568.2-lts   # weekly line: jenkins/jenkins:2.576
# update the tag in compose/Helm values (jenkins chart: controller.image.tag) and recreate the controller

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

If you cannot patch yet

• If you cannot update, the Jenkins project publishes a Java agent workaround (SECURITY-3911/3930) at https://github.com/jenkinsci-cert/SECURITY-3911-3930/: add -javaagent:/path/to/security3911-3930-workaround.jar to the controller JVM (e.g. JAVA_ARGS in /etc/default/jenkins) and remove it again after updating.
• Limit who has Agent/Connect permission and avoid running untrusted builds on agents connected to a sensitive controller.

Related vulnerabilities

• CVE-2026-70427

Sources

• Jenkins Security Advisory 2026-08-05 (SECURITY-3911)
• SECURITY-3911/3930 workaround Java agent
• CVE-2026-70426 on CVE.org
• CVE-2026-70426 on NVD

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.