In Jenkins versions 2.579 and earlier, as well as LTS 2.568.2 and earlier, objects that store their configuration in separate top‑level files can be embedded as nested fields inside user‑submitted config.xml documents. When these nested objects process HTTP requests via Stapler, an attacker can cause the Jenkins server to execute arbitrary code with its own privileges. The flaw arises from improper handling of nested configuration objects and is classified under CWE‑915 and CWE‑94.

The vulnerability affects Jenkins Project’s Jenkins server shipped in releases up to 2.579 and LTS 2.568.2. Users running those versions, especially when job or global configuration files include the affected object types, are susceptible.

The CVSS score of 8.8 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to submit a crafted config.xml file through authorized HTTP requests to Jenkins, such as by creating or updating a job or a global configuration. Successful exploitation would allow the attacker to run arbitrary code as the Jenkins service, potentially compromising the entire infrastructure. Existing mitigations are minimal, so rapid remediation is essential.