Jenkins patches 15 bugs, including an RCE and an admin takeover flaw
Jenkins' 28 October advisory covers 15 core vulnerabilities, from an XStream deserialisation RCE to a race condition that lets an unauthenticated attacker create an admin account during setup.
Jenkins published a security advisory on 28 October covering 15 vulnerabilities, all in core rather than plugins. Thirteen are rated High and two Medium. Fixed versions are weekly 2.588 and LTS 2.580.2; anything on weekly up to 2.587 or LTS up to 2.580.1 is affected.
The most serious is a remote code execution bug: a custom XStream converter fails to apply Jenkins’ deserialisation filter to classes referenced by a resolves-to attribute, letting an authenticated user instantiate arbitrary types on the server. Separately, a race condition in the setup wizard lets an unauthenticated attacker create an admin account outright. The rest of the batch spans a symlink-following bug that allows arbitrary file reads, a path traversal that can overwrite an agent’s config.xml, several stored XSS issues, and a “remember me” cookie that survives API token revocation.
Why it matters: Jenkins is still the default CI/CD server behind a huge share of self-hosted build pipelines, and this release closes the kind of holes that turn a build server into a way into everything it touches. If your instance is below the fixed versions, this is an upgrade-this-week item, not a backlog ticket, particularly if anonymous read access is enabled anywhere.
The caveat: Jenkins says it has no evidence of active exploitation. This is a disclosure, not a confirmed-attack alert, but deserialisation bugs like the XStream one have a history of being weaponised quickly once they’re public.