CVE-2026-19429: 
Jenkins vulnerability analysis and mitigation

CVE-2026-19429 is a symlink validation bypass vulnerability in Jenkins (FilePath.untarFrom()) that allows authenticated users with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem via a crafted tar archive. It affects Jenkins weekly releases through 2.577 and LTS releases through 2.568.2. The CVE has been marked as Rejected by its CVE Numbering Authority (TuranSec), though technical details were published prior to rejection. It was assigned a CVSS v3.1 score of 8.8 (High) by NVD and 6.5 (Medium) by ENISA, with a CVSSv4 base score of 9.4 (Critical) (Feedly, EUVD).

The vulnerability is rooted in two distinct weaknesses in FilePath.untarFrom() classified as CWE-59 (Improper Link Resolution Before File Access / Link Following) and CWE-184 (Incomplete List of Disallowed Inputs). First, the fix for CVE-2026-33001 validates symlink destinations (file locations) during tar extraction in FilePath.java but fails to validate symlink targets, meaning a symlink physically located inside the workspace can still point to arbitrary paths outside it — enabling disclosure of any file readable by the Jenkins process user. Second, the blank-name check introduced by CVE-2026-70427 uses String.isBlank(), which can be bypassed using Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), allowing symlinks with invisible names to be created pointing to arbitrary targets. An attacker exploits this by configuring a Jenkins job to extract a malicious tar archive that creates such symlinks, resolving to sensitive paths such as $JENKINS_HOME/secrets/ (Feedly).

Successful exploitation allows any authenticated user with Item/Configure permission to read arbitrary files accessible by the Jenkins process user, including highly sensitive files such as secrets/master.key, credentials.xml, and other configuration files stored in $JENKINS_HOME. Disclosure of these secrets could enable an attacker to decrypt stored credentials, pivot to connected systems, and fully compromise the CI/CD pipeline and downstream infrastructure. The primary impact is confidentiality (credential/token disclosure), with potential for significant lateral movement given the privileged nature of Jenkins secrets (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication. The EPSS score is approximately 0.0066 (0.66%), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with Item/Configure permission, limiting the attack surface compared to unauthenticated vulnerabilities (Feedly).

1. Obtain access: Authenticate to the Jenkins instance with an account that has Item/Configure permission on at least one job.
2. Craft malicious tar archive: Create a tar archive containing a symlink whose physical location is inside the expected workspace directory but whose target points to a sensitive path outside the workspace (e.g., ../../../../secrets/master.key). To bypass the blank-name check, use a symlink name composed of Unicode zero-width characters (e.g., U+200B) instead of an empty string.
3. Configure job to extract archive: Set up or modify a Jenkins job to invoke FilePath.untarFrom() with the crafted tar archive — for example, via a pipeline step or build configuration that extracts an attacker-controlled archive.
4. Trigger extraction: Run the job, causing Jenkins to extract the tar archive and create the malicious symlink on the controller filesystem without triggering validation checks.
5. Read sensitive files: Access the symlink target through the job's workspace (e.g., via workspace browsing, artifact archiving, or a subsequent build step that reads the symlink), retrieving the contents of secrets/master.key, credentials.xml, or other sensitive files readable by the Jenkins process user (Feedly).

• File System: Presence of symlinks within Jenkins job workspaces pointing to paths outside the workspace, particularly targeting $JENKINS_HOME/secrets/, $JENKINS_HOME/credentials.xml, or other sensitive directories; symlink names containing Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD).
• Logs: Jenkins build logs showing tar extraction operations followed by unexpected file read activity; access to secrets/master.key or credentials.xml from within a workspace context.
• Network: Unusual outbound connections from the Jenkins controller shortly after a job run, potentially indicating exfiltration of extracted secrets.
• Process: Jenkins process reading files outside the workspace directory during or after a build step involving tar extraction (Feedly).

Update Jenkins to a patched version that properly validates both symlink targets (not just locations) and correctly identifies blank symlink names including Unicode zero-width characters. The Jenkins security advisory for this issue was published on 2026-03-19 (Jenkins Advisory). As a workaround, restrict Item/Configure permission to fully trusted users only, and monitor tar extraction operations for suspicious symlink creation patterns targeting sensitive directories such as $JENKINS_HOME/secrets/. Note that this CVE has been formally rejected by its CNA; consult the Jenkins security advisory directly for authoritative patch guidance (Feedly, Jenkins Advisory).

The CVE was assigned by TuranSec and subsequently rejected by the CVE Numbering Authority, which may indicate a duplicate, scope dispute, or administrative issue with the original assignment. The underlying technical issue — an incomplete patch for prior Jenkins symlink vulnerabilities — was noted in the ENISA EUVD database and tracked by multiple vulnerability aggregators. No significant public researcher commentary or media coverage specific to this CVE identifier was identified beyond automated vulnerability feed entries (Feedly).