{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "1.0"
              },
              {
                "last_affected": "2.576"
              },
              {
                "last_affected": "2.568.2"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "7fe1be675ae0eff7a724f202d79f919bceb696be"
            },
            {
              "last_affected": "41a9ef008120dd7d1ada33200ab71be9ca445236"
            }
          ],
          "repo": "https://github.com/jenkinsci/jenkins",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "TuranSec",
    "cwe_ids": [
      "CWE-184",
      "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19429.json"
  },
  "details": "Jenkins FilePath.untarFrom() does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks pointing to arbitrary files on the Jenkins controller. By reading the secrets directory, the attacker obtains the cryptographic keys used to sign remember-me cookies, forges a valid administrator session cookie without any admin interaction, and gains access to the Script Console for remote code execution. Jenkins 2.576 is additionally affected by a bypass of the CVE-2026-70427 blank-name check via Unicode zero-width characters (U+200B, U+200C, U+200D, U+2060, U+00AD), which Java's String.isBlank() does not recognize as whitespace.",
  "id": "CVE-2026-19429",
  "modified": "2026-08-15T11:31:07.356627054Z",
  "published": "2026-08-10T12:07:02.996Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19429.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/jenkinsci/jenkins"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19429"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.jenkins.io/security/advisory/2026-08-05/"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass and Blank-Name Check Bypass (Arbitrary File Read)"
}