15 Jenkins Core Flaws: Only One Works Without Login, but Some Need Nothing More Than Read Access

On October 28, 2026 the Jenkins project published a security advisory with fixes for 15 flaws in Jenkins core. Of the 15, 13 are rated High and 2 Medium. Affected are weekly releases up to 2.587 and LTS releases up to 2.580.1. The fixed versions are weekly 2.588 and LTS 2.580.2 (Jenkins).

This article is for companies that run Jenkins themselves. It is built on the official advisory and separates what is confirmed from what is not. The information is current as of October 30, 2026.

The same week, GitLab, another CI/CD platform, also had two flaws rated 10.0. See the GitLab article as well.

Key points

• Of the 15, one can be exploited without authentication (SECURITY-4122). The other 14 need an account with some permission (Jenkins).
• But many of the required permissions are low. Several flaws are reachable with only “Overall/Read” (permission to read Jenkins).
• Five can lead to remote code execution or are described as possibly doing so: XStream deserialization (XStream is the library used to read and write configuration files), bypass of approval for agent launch commands, symlink following, path traversal in agent names, and a race in artifact extraction.
• The advisory does not describe exploitation. None of the CVEs is in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of the October 29 data (I checked CISA’s KEV data directly).
• There is no workaround. Updating is the only fix.
• The “Anthropic OSS program” is credited as a reporter on 13 of the 15.

What happened

Only Jenkins core is covered. Plugin vulnerabilities are not part of this advisory (Jenkins).

The 15 issues

Severity is Jenkins’s own rating. The advisory gives severity ratings and CVSS 3.1 vectors but no numeric scores (Jenkins).

The source for all rows is the Jenkins advisory.

How reassuring is “only one without authentication”?

The only issue exploitable without authentication is SECURITY-4122. The user-creation endpoint does not check whether the setup wizard is complete, so while the initial administrator account is being replaced an attacker can create an administrator account. Attack complexity is rated “high” (Jenkins). It concerns a limited window during initial setup.

The other 14 need some permission. But note the following.

• Several flaws are reachable with only “Overall/Read” (SECURITY-4188, 4229, 4226, 4206, 4237). SECURITY-4188 lets an attacker overwrite agent configuration, which could lead to remote code execution
• If your setup lets anonymous users have “Overall/Read”, the bar may be even lower. That is my own reading; the advisory does not say it
• “Item/Configure” and “Agent/Configure” are permissions that developers and operations staff often hold. A compromised account or a malicious insider can reach them

A CI/CD platform is where source code, build secrets and deployment rights come together. “Only one without authentication” is true, but it is not a reason to put off updating.

The ones that can lead to remote code execution

The advisory states arbitrary code execution, or its possibility, for these five (Jenkins).

1. SECURITY-4125: XStream deserialization lets an attacker instantiate arbitrary types (possible remote code execution)
2. SECURITY-4123: bypass of approval for agent launch commands gives arbitrary code execution in the controller JVM (needs Agent/Configure)
3. SECURITY-4187: symlinks allow arbitrary file read (could lead to remote code execution)
4. SECURITY-4188: agent configuration can be overwritten (could lead to remote code execution)
5. SECURITY-4248: a race in artifact extraction allows file creation in arbitrary locations (could lead to remote code execution; can happen with parallel builds)

XStream is the library Jenkins uses to read and write configuration such as config.xml. SECURITY-4125, 4225 and 4243 are flaws in how it is used. The fix adds a type-permission mechanism, and properties to switch that off are provided in case a plugin breaks after the update (see “Notes for updating” below).

How firm is the evidence of exploitation

“Not confirmed exploited” does not mean safe. Once an advisory is public, an attack can be built from the difference between the fixed and unfixed code. That is the general view; it is not something shown for this case.

The Anthropic OSS program is among the reporters

The advisory’s credits name the “Anthropic OSS program” on 13 of the 15 issues (some alone, some jointly with other researchers; Jenkins). The other two (SECURITY-4248 and 4249) are credited to Samy Medjahed.

On its coordinated disclosure dashboard, Anthropic says it uses Claude models, including an early snapshot of Claude Mythos Preview, to find vulnerabilities in open-source software. As of October 2 the dashboard reports 29,439 candidates found, 5,674 confirmed valid, and 6,157 disclosed across 591 open-source projects. Jenkins does not appear on that dashboard (Anthropic).

So neither Jenkins nor Anthropic says in so many words that Claude found these flaws. What is clear is that AI-assisted vulnerability discovery is now producing large numbers of real fixes in open-source software. Anthropic’s other demonstration the same week is covered in the Linux kernel article.

What to do now

1. Check your Jenkins version

The version is shown at the bottom right of the Jenkins screen. Update to one of these or later.

The advisory names only these two fixed versions. If you run an older LTS line, you need to move to 2.580.2 or later (Jenkins).

2. Notes for updating

In case behavior changes after updating, the advisory documents Java system properties for troubleshooting. They are not a permanent fix (Jenkins).

• SECURITY-4125: hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION=true disables the new type permission system
• SECURITY-4225: hudson.util.RobustReflectionConverter.skipFieldValueElementTypeCheck=true disables element type validation

Both switch off protection the fix added. Use them only to troubleshoot, and remove them once you have fixed the plugin that is causing trouble.

3. Review permissions

Check the following (this review is my own suggestion, not something the advisory states).

• Whether anonymous users have “Overall/Read”
• Whether only the people who need “Item/Configure”, “Agent/Configure” and “Item/Create” hold them
• Whether Jenkins is visible from the internet. If you can keep it inside your network or behind a VPN, do

4. Check for compromise

I could not confirm any report of exploitation, but while you update it is safer to look at the following (these are also my own suggestions).

• Administrator accounts or users you do not recognize (relates to SECURITY-4122 and 4243)
• Changes you do not recognize in job or agent configuration (config.xml) (relates to SECURITY-4125 and 4188)
• Jobs or suspicious commands in the build history that you do not recognize
• Review your API tokens after updating. SECURITY-4189 was a flaw where “remember me” cookies stayed valid after the token was revoked

What not to do

• Do not put off updating because “only one is without authentication”. Some flaws are reached with low permissions
• Do not leave the troubleshooting properties on. They keep the fix’s protection switched off
• Do not leave Jenkins exposed to the internet while waiting to update
• Do not try exploit code you found online on production

What is not confirmed

• I could not confirm any report of exploitation. I also could not confirm whether exploit code is public
• Whether Claude actually found these flaws. The advisory goes only as far as the name “Anthropic OSS program”
• The advisory has no numeric CVSS scores. The severities in this article are Jenkins’s ratings (High, Medium)
• The CVSS vector for SECURITY-4243 reads scope “changed” with confidentiality and availability “none”, a different shape from the others. The confirmed impact is said to be limited to creating user records
• I have not checked how much plugin compatibility is affected by the update
• Whether fixes are backported to older LTS lines is not stated in the advisory

Related articles

• Two Critical GitLab Flaws, Not One: Why the October 12 Fix Is Not Enough: Two critical flaws in CI/CD infrastructure the same week, and what to check if you self-host
• A Severity 9.8 Linux Kernel Flaw: What the AI-Built Attack Needs, and Where Each Distribution Stands: Anthropic’s demonstration the same week, read through primary sources
• A Planted Instruction File in the Downloads Folder Can Hijack AI Coding Agents: What Forever Security Found, and What to Do Now: Another way in to the development environment
• As Breaches Mount in Japan, What Leaders Should Decide First: Zero Trust and Security in the Age of AI: A way for executives to think about it

If you’d like help checking your Jenkins version, reviewing permissions, updating, or checking for intrusion, get in touch.