Описание
Jenkins FilePath.untarFrom() does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks pointing to arbitrary files on the Jenkins controller. By reading the secrets directory, the attacker obtains the cryptographic keys used to sign remember-me cookies, forges a valid administrator session cookie without any admin interaction, and gains access to the Script Console for remote code execution. Jenkins 2.576 is additionally affected by a bypass of the CVE-2026-70427 blank-name check via Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), which Java's String.isBlank() does not recognize as whitespace.
A flaw was found in Jenkins. An authenticated remote attacker with low privileges could exploit an incomplete patch related to symlink validation during tar archive extraction. This vulnerability allows the attacker to bypass symlink target validation, enabling them to read arbitrary files on the Jenkins controller filesystem. This could lead to the disclosure of sensitive information, such as master keys and credentials.
Отчет
Jenkins, as shipped in OpenShift Developer Tools and Services (ocp-tools-4), is affected by an incomplete fix for a previously addressed symlink validation issue (CVE-2026-33001). An authenticated user who holds Item/Configure permission on a job can craft a tar archive containing a symlink that still resolves outside the job workspace during extraction, allowing them to read arbitrary files on the Jenkins controller filesystem, including sensitive files such as master.key and credentials.xml. Exploitation requires an existing authenticated account with Item/Configure permission; it is not exploitable by anonymous or unauthenticated users. Red Hat assesses the direct impact of this flaw as unauthorized read access to files on the controller, affecting confidentiality only. Some public sources score this issue higher by factoring in a potential follow-on compromise using the disclosed credentials, which Red Hat treats as a separate, subsequent exploitation step rather than part of this flaw itself. No upstream fix is available from the Jenkins project at this time. Red Hat is monitoring for an upstream patch and will update this assessment and ship a fix once one becomes available.
Меры по смягчению последствий
Until an upstream fix is available, limit Item/Configure permission on Jenkins jobs to trusted administrators only, and avoid allowing untrusted or low-privileged users to configure or run jobs that extract tar archives. If untrusted users have held Item/Configure access, rotate Jenkins credentials and the controller master key as a precaution. Where possible, restrict network access to the Jenkins controller to trusted networks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Affected |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers tar extraction via POST /job/{name}/build, writing persistent symlinks into the tool cache. Symlinks to secrets/master.key, hudson.util.Secret, credentials.xml, and users/*/config.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all credentials and admin API tokens without bcrypt cracking, achieving RCE.
6.5 Medium
CVSS3