PT-2026-26073 · Jenkins+1 · Jenkins+1

Elie Metahri + 3 · Published 2026-03-18 · Updated 2026-05-24 · CVE-2026-33001

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.554 and earlier Jenkins LTS versions 2.541.2 and earlier

Description The software does not safely handle symbolic links when extracting .tar and .tar.gz archives. This allows crafted archives to write files to arbitrary locations on the filesystem, limited by the file system access permissions of the user running Jenkins. An attacker with Item/Configure permission, or control over agent processes, can exploit this to deploy malicious scripts or plugins on the controller.

Recommendations Update Jenkins to a version later than 2.554. Update Jenkins LTS to a version later than 2.541.2.

Fix

RCE

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

BDU:2026-04250

BIT-JENKINS-2026-33001

CVE-2026-33001

GHSA-R6QV-FRPC-Q66C

Affected Products

Jenkins

Red Os

References · 18

• https://bdu.fstec.ru/vul/2026-04250 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33001 · Security Note
• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3657 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r6qv-frpc-q66c · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2026-33001 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.555 · Note
• https://github.com/jenkinsci/jenkins/commit/6dc99937605d5bddfeaae43a4cd14c2571e23adc · Note
• https://twitter.com/pulsepatchio/status/2043165418085343669 · Twitter Post
• https://twitter.com/AndreGironda/status/2034745679927775725 · Twitter Post
• https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-33001 · Note
• https://twitter.com/the_yellow_fall/status/2034643555822789029 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2026-33001-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-jenkins-cve-2026-33001-7.3 · Note