Dashboard / CVE-2026-42521

CVE-2026-42521

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-04-29 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: High
A: None

Description

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
jenkins matrix_authorization_strategy 2.1 – 3.2.10
jenkins matrix_authorization_strategy 2.0
jenkins matrix_authorization_strategy 2.0
jenkins matrix_authorization_strategy 2.0

References & Advisories (1)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.25%
Raw Score 0.002460
Percentile 15.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00246
2026-10-28
0.00246

Intelligence Sources

nvd ref →

External Links