In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins
    deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml`
    submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate
    any user and send HTTP requests on their behalf, up to and including use of the Script Console to run
    arbitrary code, or to read arbitrary files from the Jenkins controller. (CVE-2026-53435)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 35598415-56de-4562-959c-11fb1fd2d995 advisory.

    Jenkins Security Advisory 2026-06-10:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.555.3 or Jenkins weekly prior to 2.568. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape     the user-provided description of a generic offline cause that could be set through the `POST config.xml`     API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with     Agent/Configure permission. (CVE-2026-53441)

  - In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins     deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml`     submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate     any user and send HTTP requests on their behalf, up to and including use of the Script Console to run     arbitrary code, or to read arbitrary files from the Jenkins controller. (CVE-2026-53435)

  - Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login     is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing     attackers to perform phishing attacks. (CVE-2026-53436)

  - Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login     is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing     attackers to perform phishing attacks. (CVE-2026-53437)

  - A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with     Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have     permission to view. (CVE-2026-53438)

  - Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with     Overall/Read permission to determine other users' configured timezone and to enumerate view names of other     users' My Views. (CVE-2026-53439)

  - Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the from parameter in the     Delegate to servlet container security realm is safe to redirect to after login, allowing attackers to     perform phishing attacks by redirecting users to an attacker-controlled domain. (CVE-2026-53440)

  - Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml     submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins     controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins     controller file system. (CVE-2026-53442)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
445955	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-g2xq-2v27-4rh3)	Tenable Cloud Security	SCA Checks	Local	high
445955	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-g2xq-2v27-4rh3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
321613	FreeBSD : jenkins -- multiple vulnerabilities (35598415-56de-4562-959c-11fb1fd2d995)	Nessus	FreeBSD Local Security Checks	Local	medium
320383	Jenkins LTS < 2.555.3 / Jenkins weekly < 2.568 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	medium

Detections

Analytics

CVE-2026-53435

high

Tenable Plugins

high

high

medium

medium