CVE-2026-19429
Description
A flaw was found in Jenkins. An authenticated remote attacker with low privileges could exploit an incomplete patch related to symlink validation during tar archive extraction. This vulnerability allows the attacker to bypass symlink target validation, enabling them to read arbitrary files on the Jenkins controller filesystem. This could lead to the disclosure of sensitive information, such as master keys and credentials.
Statement
Jenkins, as shipped in OpenShift Developer Tools and Services (ocp-tools-4), is affected by an incomplete fix for a previously addressed symlink validation issue (CVE-2026-33001). An authenticated user who holds Item/Configure permission on a job can craft a tar archive containing a symlink that still resolves outside the job workspace during extraction, allowing them to read arbitrary files on the Jenkins controller filesystem, including sensitive files such as master.key and credentials.xml.
Exploitation requires an existing authenticated account with Item/Configure permission; it is not exploitable by anonymous or unauthenticated users. Red Hat assesses the direct impact of this flaw as unauthorized read access to files on the controller, affecting confidentiality only. Some public sources score this issue higher by factoring in a potential follow-on compromise using the disclosed credentials, which Red Hat treats as a separate, subsequent exploitation step rather than part of this flaw itself.
No upstream fix is available from the Jenkins project at this time. Red Hat is monitoring for an upstream patch and will update this assessment and ship a fix once one becomes available.
Mitigation
Until an upstream fix is available, limit Item/Configure permission on Jenkins jobs to trusted administrators only, and avoid allowing untrusted or low-privileged users to configure or run jobs that extract tar archives. If untrusted users have held Item/Configure access, rotate Jenkins credentials and the controller master key as a precaution. Where possible, restrict network access to the Jenkins controller to trusted networks.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
