CVE-2026-42521
published 2026-04-29CVE-2026-42521: Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.25%
15.7th percentile
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_binding | — | — |
| jenkins | credentials_binding_plugin | — | — |
| jenkins | github | — | — |
| jenkins | github_branch_source | — | — |
| jenkins | github_branch_source_plugin | — | — |
| jenkins | github_plugin | — | — |
| jenkins | html_publisher | — | — |
| jenkins | html_publisher_plugin | — | — |
| jenkins | matrix_authorization_strategy | — | — |
| jenkins | matrix_authorization_strategy | — | — |
| jenkins | matrix_authorization_strategy | >= 2.1 < 3.2.10 | 3.2.10 |
| jenkins | matrix_authorization_strategy_plugin | — | — |
| jenkins | script_security | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins_project | jenkins_matrix_authorization_strategy_plugin | 2.0-beta-1 – 3.2.9 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Jenkins Matrix Authorization Strategy Plugin up to 3.2.9 Configuration permission (EUVD-2026-26222 / Nessus ID 310885)
vuldb·2026-04-29·CVSS 6.5
CVE-2026-42521 [MEDIUM] Jenkins Matrix Authorization Strategy Plugin up to 3.2.9 Configuration permission (EUVD-2026-26222 / Nessus ID 310885)
A vulnerability described as critical has been identified in Jenkins Matrix Authorization Strategy Plugin up to 3.2.9. This affects an unknown function of the component Configuration Handler. Executing a manipulation can lead to permission issues.
This vulnerability appears as CVE-2026-42521. The attack may be performed from remote. There is no available exploit.
GHSA
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
ghsa·2026-04-29
CVE-2026-42521 [MEDIUM] CWE-502 Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated.
This can be abused by attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Matrix Authorization Strategy Plugin 3.2.10 verifies that the class being instantiated is an inheritance strategy implementation, preventing instantiation of arbitrary types.
Jenkins
Jenkins Security Advisory 2026-04-29
vendor_jenkins·2026-04-29·CVSS 4.3
CVE-2026-42519 [MEDIUM] Jenkins Security Advisory 2026-04-29
Title: Jenkins Security Advisory 2026-04-29
Jenkins Security Advisory 2026-04-29
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Credentials Binding
Plugin
GitHub
Plugin
GitHub Branch Source
Plugin
HTML Publisher
Plugin
Matrix Authorization Strategy
Plugin
Microsoft Entra ID (previously Azure AD)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-29
Published