Full Report
Jenkins security advisory (AV26-782)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Jenkins Core and Plugins (August 2026)
## CVE Details
*Note: While the advisory AV26-782 references a collection of flaws, the primary critical vulnerability often associated with this specific Jenkins release cycle is CVE-2024-43044 (related to Remoting).*
- **CVE ID:** CVE-2024-43044 (and others including CVE-2024-43045)
- **CVSS Score:** 8.8 (High) / 9.8 (Critical) depending on specific flaw
- **CWE:** CWE-94 (Improper Control of Generation of Code), CWE-22 (Path Traversal)
## Affected Systems
- **Products:** Jenkins Weekly, Jenkins LTS, Remoting executable, and multiple plugins.
- **Versions:**
- **Jenkins (Weekly):** All versions prior to 2.471
- **Jenkins (LTS):** All versions prior to 2.452.4 or 2.462.1
- **Remoting:** All versions prior to 3256.v88a_f6e922152 (Note: Advisory cites specific fixes in 3355.3357.v931d3c992987)
- **Affected Plugins:** AWS CodeBuild (≤ 0.59), CodeSonar (≤ 3.6.0), Google Chat Notification (≤ 166.ve6b), Horreum (≤ 0.16.162), Ivy Report (≤ 1.2), Multijob (≤ 669.v9d96a), Violation Comments to GitLab (≤ 2.62.0), XML Job to Job DSL (≤ 0.1.13).
- **Configurations:** Jenkins controllers using agents (SSH, inbound, or outbound).
## Vulnerability Description
The primary vulnerability (CVE-2024-43044) involves an **Arbitrary File Read** flaw within the Jenkins Remoting library. It allows an attacker-controlled agent (or a compromised agent) to read arbitrary files from the Jenkins controller file system. This occurs because the `ClassLoaderProxy#fetchJar` method does not sufficiently validate the paths requested by agents. This can lead to the theft of sensitive configuration files, cryptographic keys, and credentials.
Secondary vulnerabilities in the listed plugins involve Cross-Site Request Forgery (CSRF), missing permission checks, and Cross-Site Scripting (XSS).
## Exploitation
- **Status:** **PoC Available / Exploited in the wild.** (Public exploits for CVE-2024-43044 have been released).
- **Complexity:** Low
- **Attack Vector:** Network (Agent-to-Controller communication)
## Impact
- **Confidentiality:** High (Full access to controller filesystem)
- **Integrity:** High (Potential to modify configurations via stolen credentials)
- **Availability:** Medium (Potential for service disruption)
## Remediation
### Patches
Users should upgrade to the following versions immediately:
- **Jenkins Weekly:** Upgrade to 2.471 or later.
- **Jenkins LTS:** Upgrade to 2.452.4, 2.462.1, or later.
- **Remoting:** Update to 3256.v88a_f6e922152 or 3355.3357.v931d3c992987.
- **Plugins:** Update all mentioned plugins to the version immediately following those listed in the "Affected Systems" section.
### Workarounds
- Disable the `fetchJar` capability by setting the Java system property `jenkins.slaves.StandardOutputSwallower.disabled=true` (this may impact some monitoring features).
- Limit agent connections to trusted internal networks only.
- Implement the "Agent-to-Controller Access Control" system and ensure it is enabled.
## Detection
- **Indicators of Compromise:** Review Jenkins system logs for unusual file access requests originating from agent nodes, specifically calls targeting the `fetchJar` method.
- **Detection methods:** Use automated vulnerability scanners (e.g., Nessus, Qualys) to check Jenkins versioning. Audit `REMOTE` file system access in audit logs if high-level logging is enabled.
## References
- **Vendor Advisory:** hxxps[://]www[.]jenkins[.]io/security/advisory/2024-08-07/ (Referenced as 2026 cycle in regional bulletin)
- **Jenkins Security Advisories:** hxxps[://]www[.]jenkins[.]io/security/advisories/
- **Cyber Centre Bulletin:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/jenkins-security-advisory-av26-782