Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 10, 2018 · Catalog

   Detected

   A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

2. Feb 10, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Aug 10, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Affected

• cpe jenkins/jenkinsversion unspecified
• cpe redhat/openshift container platform3.11
• vendor Jenkins Jenkins Stapler Web Frameworkversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2018-1000861

  A code execution vulnerability exists in the Stapler web framework used by Jenkins

  cisa.gov
• CVE.orgVulnerability recordCVE-2018-1000861

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2018-1000861

  30-day exploitation probability 98.3%

  first.org
• Metasploit ModulesPublic exploit moduleexploit_multi/http/jenkins_metaprogramming

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2018-1000861

  A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs th

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Third Party Advisory · packetstormsecurity.com
• Broken Link · securityfocus.com
• Third Party Advisory · access.redhat.com
• Vendor Advisory · jenkins.io
• CISA note · nvd.nist.gov