Deserialization of untrusted data in Jenkins Matrix Authorization Strategy Plugin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins Matrix Authorization Strategy Plugin | 2.0-beta-1 – 3.2.9 | — | No fix listed | CNA |
| — | org.jenkins-ci.plugins:matrix-auth (Maven) | 2.0-beta-1 to before 3.2.10 | 3.2.10 | Patch available | GHSA-jp9r-mmhw-vff3 |
- Jenkins Matrix Authorization Strategy Plugin VendorJenkins Affected 2.0-beta-1 – 3.2.9 Fixed in — No fix listed CNA
- org.jenkins-ci.plugins:matrix-auth (Maven) Vendor— Affected 2.0-beta-1 to before 3.2.10 Fixed in 3.2.10 Patch available GHSA-jp9r-mmhw-vff3
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:matrix_authorization_strategy:*:*:*:*:*:jenkins:*:* | 2.1 to before 3.2.10 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta1:*:*:*:jenkins:*:* | 2.0 beta1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta2:*:*:*:jenkins:*:* | 2.0 beta2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta3:*:*:*:jenkins:*:* | 2.0 beta3 | Vulnerable | Jenkins |
- cpe:2.3:a:jenkins:matrix_authorization_strategy:*:*:*:*:*:jenkins:*:* Versions 2.1 to before 3.2.10 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta1:*:*:*:jenkins:*:* Versions 2.0 beta1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta2:*:*:*:jenkins:*:* Versions 2.0 beta2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta3:*:*:*:jenkins:*:* Versions 2.0 beta3 Vulnerable ·Jenkins
Remediation
- Fix · GHSA-jp9r-mmhw-vff3 org.jenkins-ci.plugins:matrix-auth (Maven) Fixed in 3.2.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42521
- 2026-10-03 Alias added: GHSA-jp9r-mmhw-vff3
References
More Jenkins Matrix Authorization Strategy vulnerabilities
- TI-2021-04703 Incorrect authorization in Jenkins Matrix Authorization Strategy Plugin CVSS 3.1MEDIUM 6.5
- TI-2020-02103 Cross-site scripting in Jenkins Matrix Authorization Strategy Plugin CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-42521 · CVE Program
- CVE-2026-42521 · NVD
- FIRST EPSS
- GHSA-jp9r-mmhw-vff3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences