Jenkins 2.568.3 LTS - 13 Core Security Fixes And Jetty 12.1.12

Jenkins LTS 2.568.3, a stable release published on September 2, 2026, ships the core fixes for 13 issues from the same day security advisory. Six are rated High, and the worst lets crafted config.xml content reach an improperly protected Script Console, which means remote code execution.

The full release notes and downloads are on the GitHub release page. The GitHub notes list no changes and point to the LTS changelog and the 2.568 upgrade guide. The changelog has two entries, “Important security fixes” and a Winstone update. The details below come from the security advisory linked there. The matching weekly release is 2.580.

Five of the fixes close holes in how Jenkins turns submitted XML and form data into Java objects.

  • SECURITY-3972 (High). Types that store configuration in their own file, such as agents, items and builds, could appear as nested field values in a submitted config.xml. Stapler would then route HTTP requests to them. A crafted mix of these objects led to the Script Console. Jenkins now refuses to deserialize those types as nested values.
  • SECURITY-3908 (Medium). The same trick let anyone with Overall/Read create user objects. These are not real accounts and cannot log in. User objects are now treated as top level types, so the fix above covers them.
  • SECURITY-3915 (High). Stapler form binding did not check that the instantiated type fits the field type. Overall/Read was enough to instantiate unrelated configuration types.
  • SECURITY-3926 (Medium). Form binding could set public static fields, which changes behavior for the whole controller.
  • SECURITY-4032 (High). Fields declared transient were still read back during deserialization. Core adds a way to mark such fields as excluded. Only marked fields are skipped, so the protection depends on core and plugin code using the marker.

The advisory lists no known regressions. Stricter binding can still break an old plugin that relied on the loose behavior. If you manage jobs or agents by posting config.xml, test those round trips in staging.

The first two need an attacker who serves content on the same site as Jenkins, such as a sibling subdomain. That is common when Jenkins shares a parent domain with an orchestrator UI or dashboards.

  • SECURITY-3878 (High). Dynamically generated JavaScript resources embedded the user’s CSRF crumb as a string literal. A page on the same site could load that script and read a valid crumb. The advisory says the risk is highest when the Resource Root URL sits on the same site as Jenkins. The script now reads the crumb from the page DOM at runtime. If you cannot upgrade yet, disable Resource Root URL or move it to a different domain.
  • SECURITY-4016 (High). Logging in through the “remember me” cookie did not rotate the session. A host on the same site could plant a session cookie and inherit the login. Jenkins now invalidates the old session.
  • SECURITY-3967 (High). The system log viewer did not escape the source, level and timestamp of log records. Anyone in control of an agent process could store XSS there. Enforcing Content Security Policy, available since LTS 2.541.1, mitigates it.

All five are rated Medium. They touch scripts and service accounts directly.

  • SECURITY-4006. An HTTP endpoint skipped the Item/Read check. With read access to one job, you could read build parameter names and values of jobs you could not see. Pipelines that pass tokens or connection strings as plain parameters exposed them.
  • SECURITY-4015. The build CLI command with -s waits for completion and cancels the build if the client is interrupted. Jenkins merges identical queued builds, so Item/Build was enough to cancel someone else’s run. The command now requires Item/Cancel when -s is used. External schedulers that call build -s may need that permission added.
  • SECURITY-4025. The REST API and CLI endpoints for agent configuration accepted XML naming a different agent. Agent/Configure on one agent could take over another one, along with its inbound secret and environment variables.
  • SECURITY-3879. The REST API did not escape map keys in JSON and Python output. Anyone who controls a map property name could inject fields. If a pipeline loads /api/json output into a warehouse, an injected field lands there as data.
  • SECURITY-3981. The Appearance page, added in 2.421, did not check permissions per option. Overall/Manage could change options it should not reach.

The only other changelog entry updates Winstone to 8.1047.x with Eclipse Jetty 12.1.12, from pull request 27193. On master that pull request is a Renovate bump from Jetty 12.1.11 and touches only pom.xml and war/pom.xml.

  • The upgrade guide says the Windows Server 2019 agent images have been dropped. Move to Windows Server 2022 or 2025, or build your own 2019 image. The 2019 controller images were already dropped in 2.568.1.
  • The same advisory covers 17 plugins, including Script Security, LDAP, SAML, GitLab and Pipeline: Groovy Libraries. Those need their own updates. The Parameterized Remote Trigger plugin had no fix at publication.
  • Check service accounts that call build -s for Item/Cancel before rollout.