CVE-2026-33001 json
Jenkins has a link following vulnerability allows arbitrary file creation
published 2026-03-18 7 mo ago modified 2026-09-10 59 d ago also BIT-jenkins-2026-33001 , EUVD-2026-12843 , GHSA-r6qv-frpc-q66c
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Patch / fix
- maven org.jenkins-ci.main:jenkins-core 2.555
- bitnami jenkins 2.541.3, 2.555.0
- Jenkins Project Jenkins 2.555
- Red Hat OpenShift Developer Tools and Services 4.12 1776764096
- Red Hat OpenShift Developer Tools and Services 4.13 1776764096
- Red Hat OpenShift Developer Tools and Services 4.14 1776762347
- Red Hat OpenShift Developer Tools and Services 4.15 1776762347
- Red Hat OpenShift Developer Tools and Services 4.16 1776944215
- Red Hat OpenShift Developer Tools and Services 4.17 1776944215
- Red Hat OpenShift Developer Tools and Services 4.18 1776944215
- Red Hat OpenShift Developer Tools and Services 4.19 1776944215
- Red Hat OpenShift Developer Tools and Services 4.20 1776944215
- Red Hat OpenShift Developer Tools and Services 4.21 1776944215
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-33001 updated cvss 8.8
jenkins: Jenkins: Arbitrary file write and potential code execution through crafted archives
-
Red Hat OpenShift Developer Tools and Services jenkinsaffected: no fix available
-
Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9affected: no fix planned “Will not fix”
-
Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4 1776764096fixed: vendor fix RHSA-2026:10209
-
Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4 1776764096fixed: vendor fix RHSA-2026:10201
-
Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4 1776762347fixed: vendor fix RHSA-2026:10211
-
Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4 1776762347fixed: vendor fix RHSA-2026:10204
-
Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4 1776944215fixed: vendor fix RHSA-2026:10214
-
Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4 1776944215fixed: vendor fix RHSA-2026:10213
show 5 moreshow fewer
-
Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4 1776944215fixed: vendor fix RHSA-2026:10215
-
Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4 1776944215fixed: vendor fix RHSA-2026:10206
-
Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4 1776944215fixed: vendor fix RHSA-2026:10205
-
Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4 1776944215fixed: vendor fix RHSA-2026:10199
-
Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4 1776760341 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4 1776760341 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4 1776760341 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4 1776760341 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4 1776944183 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4 1776944183not affected: vulnerable code not present
+4 more productsfewer
Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4 1776944183 Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4 1776944183 Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4 1776944183 Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4 1776944183
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
2.11% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.main:jenkins-core | <2.555 |
2.555 |
| bitnami | jenkins | <2.541.3 >=2.542.0, <2.555.0 |
2.541.3 2.555.0 |
Affected products
- Jenkins Project Jenkins
- Red Hat OpenShift Developer Tools and Services 4.12
- Red Hat OpenShift Developer Tools and Services 4.13
- Red Hat OpenShift Developer Tools and Services 4.14
- Red Hat OpenShift Developer Tools and Services 4.15
- Red Hat OpenShift Developer Tools and Services 4.16
- Red Hat OpenShift Developer Tools and Services 4.17
- Red Hat OpenShift Developer Tools and Services 4.18
- Red Hat OpenShift Developer Tools and Services 4.19
- Red Hat OpenShift Developer Tools and Services 4.20
- Red Hat OpenShift Developer Tools and Services 4.21
- Red Hat Red Hat Developer Hub
Classification
References
-
github.com
/jenkinsci/jenkins/commit/6dc99937605d5bddfeaae43a4cd14c2571e23adc
web
-
jenkins.io
/security/advisory/2026-03-18/#SECURITY-3657
vendor-advisory, web, advisory
-
access.redhat.com
/errata/RHSA-2026:10209
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10201
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10211
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10204
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10214
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10213
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10215
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10206
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10205
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:10199
vendor-advisory, web
-
access.redhat.com
/security/cve/CVE-2026-33001
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2448645
issue-tracking, web
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-33001.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-33001
advisory, web
-
github.com
/jenkinsci/jenkins
package
-
github.com
/jenkinsci/jenkins/releases/tag/jenkins-2.555
web
Sources
- CVE List CVE-2026-33001
- GitHub Advisory GHSA-r6qv-frpc-q66c
- NVD CVE-2026-33001
- OSV BIT-jenkins-2026-33001
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.