CVE-2026-19429 PUBLISHED

Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass and Blank-Name Check Bypass (Arbitrary File Read)

Assigner: TuranSec
Reserved: 10.08.2026 Published: 10.08.2026 Updated: 11.08.2026

Jenkins FilePath.untarFrom() does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks pointing to arbitrary files on the Jenkins controller. By reading the secrets directory, the attacker obtains the cryptographic keys used to sign remember-me cookies, forges a valid administrator session cookie without any admin interaction, and gains access to the Script Console for remote code execution. Jenkins 2.576 is additionally affected by a bypass of the CVE-2026-70427 blank-name check via Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), which Java's String.isBlank() does not recognize as whitespace.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Product Status

Vendor Jenkins Project
Product Jenkins
Versions Default: affected
  • affected from 1.0 to 2.576 (incl.)
  • affected from 1.0 to 2.568.2 (incl.)

Credits

  • Jamshed Yergashvoyev (CVE GUY | TuranSec) finder

References

Problem Types

  • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE
  • CWE-184: Incomplete List of Disallowed Inputs CWE