Report: Latest: CVE-2026-42521 - Jenkins Matrix Authorization Strategy Plugin Deserialization RCE

Report: Latest: CVE-2026-42521 - Jenkins Matrix Authorization Strategy Plugin Deserialization RCE

CVE ID :CVE-2026-42521 Published : April 29, 2026, 2:16 p.m. | 45 minutes ago Description :Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

Published
April 29, 2026
Affected Product: Jenkins
Impact: information disclosure