A critical vulnerability in Jenkins, tracked as CVE-2026-70426, may allow attackers to execute arbitrary code on Jenkins controllers by bypassing deserialization protections within the platform’s Remoting library.
  • nymnympseudonym@piefed.socialEnglish
    5·
    24 days ago

    serialized Java objects

    Any project that is using Java serialization with readObject() is inherently insecure. It blows my mind that people keep corporate secret keys in Jenkins vaults.

    Solarwinds II: secret key boogaloo!