CVE-2026-42521
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42521?
The severity of CVE-2026-42521 is considered high due to potential remote code execution risks.
How do I fix CVE-2026-42521?
To fix CVE-2026-42521, upgrade the Jenkins Matrix Authorization Strategy Plugin to version 3.2.10 or later.
What versions are affected by CVE-2026-42521?
CVE-2026-42521 affects Jenkins Matrix Authorization Strategy Plugin versions from 2.0-beta-1 to 3.2.9.
What kind of attacks can exploit CVE-2026-42521?
CVE-2026-42521 can potentially allow attackers to execute arbitrary code via deserialization flaws.
Is user interaction required to exploit CVE-2026-42521?
No user interaction is required to exploit CVE-2026-42521 as it can be triggered by manipulating deserialization processes.