CVE-2026-19429

CVE-2026-19429 is a symlink target injection vulnerability in Jenkins' FilePath.untarFrom() method that allows reading arbitrary controller files by extracting crafted archives from job workspaces. The CVE represents a bypass of the earlier CVE-2026-33001 patch, which addressed workspace containment but fundamentally misunderstood the threat model — it validated where symlink entries land, not where they point. The core issue: when processing archive entries, Jenkins validates that the symlink file itself resides within the workspace boundary but performs zero validation on the target path the symlink resolves to. An attacker with Item/Configure permission can create a job configuration containing a crafted archive that, when extracted, places a symlink in the workspace pointing to $JENKINS_HOME/secrets/master.key or other sensitive controller files. When that symlink resolves during workspace browsing, the attacker can then download the linked content as an artifact. What makes this significant is not the CVSS score — which is MEDIUM because it requires Item/Configure permission — but the cascade. Jenkins stores cryptographic material in predictable, enumerable locations under $JENKINS_HOME/secrets/. The vulnerability creates a path from workspace operations to credential material that the job isolation model never accounted for. The CVE-2026-33001 patch treated the problem as file placement; CVE-2026-19429 reveals that the actual attack surface is path resolution. Jenkins has a documented history of symlink-related CVEs dating back to 2018, including CVE-2018-1999002 and CVE-2019-1003000. The CVE-2026-33001 patch authors had access to this vulnerability genealogy and still chose to patch the symptom rather than the mechanism. This reflects not a timeline failure but an institutional failure to apply accumulated knowledge about symlink handling in archive extraction. Defenders should: immediately audit any job configurations that extract archives from untrusted sources, regardless of who configured them; treat archive extraction from job configurations as an untrusted operation even when performed by authorized users; and recognize that the trust model assumption — that Item/Configure implies a legitimate operator rather than an attacker — was never interrogated in the original codebase design.

Reviewed through automated stages and approved by a human before publication.