Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier, allow an attacker to submit a crafted config.xml that is deserialized into arbitrary core or plugin types. This flaw can be used to impersonate any Jenkins user, send HTTP requests on their behalf, exploit the Script Console to run arbitrary code, or read arbitrary files from the controller. The vulnerability therefore enables complete compromise of confidentiality, integrity, and availability of the Jenkins instance.

Product: Jenkins. Vendor: Jenkins Project. Affected releases are Jenkins 2.567 and all earlier 2.x releases, as well as the 2.555.2 LTS release and all earlier LTS versions.

Because the flaw can be triggered by supplying a config.xml file, an attacker with network access to the Jenkins UI or API can exploit it remotely without additional credentials. The vulnerability can lead to full remote code execution. EPSS is not available and the flaw is not listed in the CISA KEV catalog, but the potential impact and the absence of a mitigation requirement for the user operator mean the risk remains high. The flaw is most likely to be exploited by attackers with moderate skill who target Jenkins installations that have not been patched or hardened against unauthorized configuration uploads.