GHSA-jp9r-mmhw-vff3

Suggest an improvement
Source
https://github.com/advisories/GHSA-jp9r-mmhw-vff3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jp9r-mmhw-vff3/GHSA-jp9r-mmhw-vff3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jp9r-mmhw-vff3
Aliases
  • CVE-2026-42521
Downstream
Related
Published
2026-04-29T15:30:38Z
Modified
2026-05-08T03:14:27.375269718Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors
Details

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated.

This can be abused by attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

Matrix Authorization Strategy Plugin 3.2.10 verifies that the class being instantiated is an inheritance strategy implementation, preventing instantiation of arbitrary types.

Database specific 
{
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2026-04-29T14:16:19Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed_at": "2026-05-06T22:47:11Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:matrix-auth

Package

Name
org.jenkins-ci.plugins:matrix-auth
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/matrix-auth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0-beta-1
Fixed
3.2.10

Affected versions

2.*
2.0-beta-1
2.0-beta-2
2.0-beta-3
2.0
2.1
2.1.1
2.2
2.3
2.4
2.4.1
2.4.2
2.5
2.5.1
2.5.2
2.6
2.6.1
2.6.2
2.6.3
2.6.3.1
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.11
3.*
3.0
3.0.1
3.1
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9

Database specific

last_known_affected_version_range 
"<= 3.2.9"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jp9r-mmhw-vff3/GHSA-jp9r-mmhw-vff3.json"