CVE-2026-19429

Jenkins FilePath.untarFrom() does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks pointing to arbitrary files on the Jenkins controller. By reading the secrets directory, the attacker obtains the cryptographic keys used to sign remember-me cookies, forges a valid administrator session cookie without any admin interaction, and gains access to the Script Console for remote code execution. Jenkins 2.576 is additionally affected by a bypass of the CVE-2026-70427 blank-name check via Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), which Java's String.isBlank() does not recognize as whitespace.

• CWE-59
• CWE-184

• https://github.com/jenkinsci/jenkins
• https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657
• https://www.jenkins.io/security/advisory/2026-08-05/

Published

Aug 10, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19411A NULL pointer vulnerability has been found in the the shim …3.9
• CVE-2026-19418The referrer enforcement introduced with TYPO3-CORE-SA-2020-…7.3
• CVE-2026-1942The Blog2Social: Social Media Auto Post & Scheduler plugin f…6.5
• CVE-2026-19424Chiline Cloud developed by Inventec Appliances has a Insecur…7.5
• CVE-2026-19425Travel Agency Management System developed by Win Men Interma…9.8
• CVE-2026-19426POS System developed by FitSoft has a Missing Authentication…8.8
• CVE-2026-1943The YayMail – WooCommerce Email Customizer plugin for WordPr…4.4
• CVE-2026-19433Authorization Bypass Through User-Controlled Key in the cont…8.6
• CVE-2026-19434Cross-site Scripting in the finding renderer in maalfer Pent…5.1
• CVE-2026-1944The CallbackKiller service widget plugin for WordPress is vu…5.3
• CVE-2026-1945The WPBookit plugin for WordPress is vulnerable to Stored Cr…7.2
• CVE-2026-1946The GW AI Website Builder plugin for WordPress is vulnerable…4.3