Loading vulnerability…
CVE-2026-53435 (SECURITY-3707) is an unsafe deserialization vulnerability in Jenkins weekly 2.567 and earlier and Jenkins LTS 2.555.2 and earlier. Insufficient type enforcement allows an attacker-controlled configuration XML submission to instantiate arbitrary types supplied by Jenkins core or installed plugins. Although Jenkins class filtering restricts types to permitted Jenkins namespaces, vulnerable processing of deserialized container properties does not reliably ensure that instantiated objects match the expected property type. An attacker can subsequently reach a planted object through Jenkins Stapler HTTP routing and invoke exposed request-handling behavior. This enables user impersonation, attacker-controlled requests in the impersonated user's context, arbitrary file access, and potential Script Console access for code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a working Python proof-of-concept for CVE-2026-53435 against Jenkins, plus a self-contained Docker lab for vulnerable and patched instances. The main exploit file, exploit_cve_2026_53435_v2.py, authenticates to Jenkins with HTTP Basic Auth, optionally retrieves a CSRF crumb from /crumbIssuer/api/json, verifies identity via /whoAmI/api/json, and submits crafted XML to either /createView?name=<name> or /view/<name>/config.xml. The XML injects a hudson.Plugin$DummyImpl object into a ListView <properties> DescribableList using a pre-patch type-enforcement weakness. The injected object embeds baseResourceURL=file:/, and the exploit then triggers Stapler routing with GET /view/<name>/properties/0/<requested path> to return arbitrary controller-local file contents such as /etc/passwd. Exploit capability is authenticated arbitrary file read on the Jenkins controller. The README notes broader impact such as impersonation and Script Console RCE exists conceptually, but those chains are intentionally withheld and are not implemented in the analyzed exploit. Therefore this repository is a real exploit, not merely a detector, and its maturity is OPERATIONAL: it includes a concrete payload and end-to-end exploitation logic, but not a generalized framework. Repository structure: README.md documents the vulnerability, affected/fixed versions, usage, and validation against vulnerable 2.555.2 versus patched 2.555.3. exploit_cve_2026_53435_v2.py is the primary entry point and only active exploit code. The lab/ directory provides reproducible infrastructure: Dockerfile and docker-compose.yml spin up vulnerable Jenkins, patched Jenkins, and an OOB listener; init.groovy.d/01-setup.groovy provisions admin and lowpriv users with matrix-auth permissions; candidates.txt and lab/README.md describe additional lab-only discovery/canary workflows, but those referenced scripts are not present in this repository. Overall, the repo’s purpose is to demonstrate and reproduce authenticated Jenkins deserialization leading to arbitrary file read via malicious view configuration and routable core object injection.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity Jenkins unsafe deserialization vulnerability that lets a minimally privileged authenticated user supply crafted configuration data, potentially enabling HTTP request interception/modification, Jenkins controller compromise, confidential-file access, and remote code execution.
A high-severity Jenkins core unsafe deserialization vulnerability. An attacker able to submit a controlled config.xml can deserialize arbitrary Jenkins core or plugin types, potentially impersonate users, make HTTP requests as them, execute arbitrary code using the Script Console, and read files from the Jenkins controller.
A Jenkins deserialization vulnerability that allows an authenticated attacker to plant arbitrary Jenkins core/plugin types via config.xml and then reach them through Stapler routing, enabling impacts including arbitrary file read, user impersonation, and Script Console access/RCE.
A critical Jenkins remote code execution vulnerability caused by deserialization of attacker-controlled types via submitted config.xml, enabling impersonation of users, sending HTTP requests on their behalf, access to the Script Console, code execution, and reading sensitive files from the controller.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.