CVE-2026-19429

Received Received - Intake

Path Traversal in Jenkins via Incomplete Tar Archive Patch

Publication date: 2026-08-10

Last updated on: 2026-08-13

Assigner: TuranSec

Description

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-13

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-13

NVD

CVE-2026-19429

EUVD

EUVD-2026-55615

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	jenkins	2.555.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability is an incomplete patch for CVE-2026-33001 in Jenkins. It allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem using a crafted tar archive. The patch validates symlink destinations but not targets, so a symlink inside the workspace can point outside it to access sensitive files like secrets/master.key or credentials.xml.

Detection Guidance

To detect this vulnerability, monitor for suspicious symlink creation in Jenkins workspaces or unusual access to $JENKINS_HOME/secrets/ files. Check for unauthorized extraction of .tar/.tar.gz archives in Jenkins jobs. Review workspace viewer access logs for GET /job/{name}/ws/ requests. Inspect job configurations for Item/Configure permissions granted to untrusted users.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive files on the Jenkins server, including configuration files and secrets. This may lead to unauthorized data exposure, potential system compromise, or further attacks within the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Unauthorized file access may result in data breaches, triggering legal penalties and regulatory fines.

Mitigation Strategies

Upgrade Jenkins to a version that includes a complete patch for CVE-2026-33001 or later. Ensure the update validates both symlink destinations and targets during tar extraction to prevent arbitrary file reads.

Hi! I’m here to help you understand CVE-2026-19429. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70