{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19429", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T12:06:37.123Z", "datePublished": "2026-08-10T12:07:02.996Z", "dateUpdated": "2026-08-10T18:21:50.651Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T17:01:08.287Z"}, "title": "Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass (Arbitrary File Read)", "datePublic": "2026-08-10T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001 patch applied, validates symlink destinations but not targets. The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \u2014 the path returned by te.getLinkName() and passed directly to symlinkTo() \u2014 is never validated and may point to any path on the controller filesystem. An attacker with Item/Configure permission can configure a job to extract a malicious .tar or .tar.gz archive via a tool installer or custom build step. When FilePath.untarFrom() processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths. By targeting the entire $JENKINS_HOME/secrets/ directory \u2014 including master.key, hudson.util.Secret, hudson.model.Secrets.xml, and any other files present \u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (GET /job/{name}/ws/) or build artifacts. Combined with credentials.xml and per-user config.xml files, this enables offline AES-128 decryption of all {AQA...}-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \u2014 compromising all downstream systems those credentials protect.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Jenkins <code>FilePath.untarFrom()</code> in all versions, including those with the CVE-2026-33001 patch applied, validates symlink <strong>destinations</strong> but not <strong>targets</strong>.</p><p>The CVE-2026-33001 fix enforces that the symlink file is created within the workspace boundary, but the symlink target \u2014 the path returned by <code>te.getLinkName()</code> and passed directly to <code>symlinkTo()</code> \u2014 is never validated and may point to any path on the controller filesystem.</p><p>An attacker with <strong>Item/Configure</strong> permission can configure a job to extract a malicious <code>.tar</code> or <code>.tar.gz</code> archive via a tool installer or custom build step. When <code>FilePath.untarFrom()</code> processes the archive, it creates symlinks inside the workspace that resolve to arbitrary controller paths.</p><p>By targeting the entire <code>$JENKINS_HOME/secrets/</code> directory \u2014 including <code>master.key</code>, <code>hudson.util.Secret</code>, <code>hudson.model.Secrets.xml</code>, and any other files present \u2014 an attacker can exfiltrate all Jenkins cryptographic material through the workspace viewer (<code>GET /job/{name}/ws/</code>) or build artifacts.</p><p>Combined with <code>credentials.xml</code> and per-user <code>config.xml</code> files, this enables offline AES-128 decryption of all <code>{AQA...}</code>-format credential entries, exposing in plaintext every password, API key, cloud provider secret, and SSH private key stored in the Jenkins credential store \u2014 compromising all downstream systems those credentials protect.</p>"}]}], "affected": [{"vendor": "Jenkins Project", "product": "Jenkins", "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657", "name": "Jenkins Security Advisory 2026-03-18 (CVE-2026-33001 \u2014 incomplete fix)", "tags": ["related"]}, {"url": "https://github.com/jenkinsci/jenkins", "name": "Jenkins Source Repository", "tags": ["third-party-advisory"]}], "timeline": [{"time": "2026-04-04T00:00:00.000Z", "lang": "en", "value": "Vulnerability discovered via patch-diff analysis of CVE-2026-33001 fix"}, {"time": "2026-08-05T00:00:00.000Z", "lang": "en", "value": "Re-verified against Jenkins 2.557 and LTS 2.555.3 \u2014 still unpatched"}, {"time": "2026-08-10T12:00:00.000Z", "lang": "en", "value": "Public disclosure (90-day window exceeded)"}], "credits": [{"lang": "en", "value": "Jamshed Yergashvoyev (CVE GUY | TuranSec)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T15:34:41.496974Z", "id": "CVE-2026-19429", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:21:50.651Z"}}]}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Jenkins", "source": "cna", "vendor": "Jenkins Project"}, "product": "jenkins", "vendor": "jenkins_project"}], "created": "2026-08-10T13:30:05.001026+00:00", "updated": "2026-08-10T18:00:03.744270+00:00", "vendors": ["jenkins_project", "jenkins_project$PRODUCT$jenkins"]}