CVE-2026-84670

The Jenkins Performance Plugin, versions 1015.v09ca_52b_3370e and earlier, deserializes cached performance reports stored in the build directory on the Jenkins controller without restricting which classes can be instantiated, an unsafe deserialization flaw (CWE-502). An attacker who holds Item/Configure permission on any job or item can cause the plugin to deserialize crafted cached report data, instantiating arbitrary classes on the controller. Successful exploitation yields arbitrary code execution on the Jenkins controller, typically under the Jenkins service account, exposing stored credentials, job configurations, and connected build agents. Any Jenkins controller running an affected version of the Performance Plugin is affected, with the greatest risk where Configure permissions are broadly granted to development teams. No public proof-of-concept or in-the-wild exploitation is currently known; EPSS places the 30-day exploitation probability at about 0.4% (percentile 31) and the issue is not in CISA KEV.

What to do: Update the Performance Plugin to a release newer than 1015.v09ca_52b_3370e as soon as a patched version is available via the Jenkins update center. Until then, restrict Item/Configure permission to trusted users and audit which jobs, folders, and accounts hold configure rights. Internet exposure is secondary here, since any authenticated user with configure rights on a controller running the affected plugin can trigger the flaw.