Skip to content
Sign in
6.5 Medium

CVE-2026-42521 Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless…

Description

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

Affected products and versions

Product Affected versions Fixed in
Jenkins Matrix Authorization Strategy Plugin 2.0 2.0-beta-1 → 3.2.9 No fix stated

Other CVEs of Jenkins Matrix Authorization Strategy Plugin

The 3 CVEs of Jenkins Matrix Authorization Strategy Plugin →
CVE-2021-21623 An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows attackers with… Not rated CVE-2020-2226 Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration,… Not rated
Track this CVE