medium6.5
CVE-2026-42521
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration…
Impact
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:matrix-auth | >= 2.0-beta-1, <= 3.2.9 | 3.2.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Matrix Authorization Strategy | from 2.1 before 3.2.10 Version 2.0 |