CVE-2026-19429
CVE-2026-19429 updated by NVD
Summary
Jenkins FilePath.untarFrom() does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 and CVE-2026-70427. An attacker can use this to read sensitive files from $JENKINS_HOME, including Jenkins cryptographic keys and stored credentials. Jenkins 2.576 is additionally affected by a Unicode zero-width character bypass of the blank-name validation introduced by CVE-2026-70427.
References
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.