CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-42521

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 24.9%

CVSS Severity

CVSS v3 Score 6.5

References

https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3676

Products affected by CVE-2026-42521

Jenkins » Matrix Authorization Strategy » Version: 2.0

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0
Jenkins » Matrix Authorization Strategy » Version: 2.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.1
Jenkins » Matrix Authorization Strategy » Version: 2.1.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.1.1
Jenkins » Matrix Authorization Strategy » Version: 2.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.2
Jenkins » Matrix Authorization Strategy » Version: 2.3

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.3
Jenkins » Matrix Authorization Strategy » Version: 2.4

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.4
Jenkins » Matrix Authorization Strategy » Version: 2.4.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.4.1
Jenkins » Matrix Authorization Strategy » Version: 2.4.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.4.2
Jenkins » Matrix Authorization Strategy » Version: 2.5

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.5
Jenkins » Matrix Authorization Strategy » Version: 2.5.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.5.1
Jenkins » Matrix Authorization Strategy » Version: 2.5.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.5.2
Jenkins » Matrix Authorization Strategy » Version: 2.6

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6
Jenkins » Matrix Authorization Strategy » Version: 2.6.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.1
Jenkins » Matrix Authorization Strategy » Version: 2.6.11

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.11
Jenkins » Matrix Authorization Strategy » Version: 2.6.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.2
Jenkins » Matrix Authorization Strategy » Version: 2.6.3

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.3
Jenkins » Matrix Authorization Strategy » Version: 2.6.3.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.3.1
Jenkins » Matrix Authorization Strategy » Version: 2.6.4

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.4
Jenkins » Matrix Authorization Strategy » Version: 2.6.5

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.5
Jenkins » Matrix Authorization Strategy » Version: 2.6.6

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.6
Jenkins » Matrix Authorization Strategy » Version: 2.6.7

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.7
Jenkins » Matrix Authorization Strategy » Version: 2.6.8

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.8
Jenkins » Matrix Authorization Strategy » Version: 2.6.9

cpe:2.3:a:jenkins:matrix_authorization_strategy:2.6.9
Jenkins » Matrix Authorization Strategy » Version: 3.0

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.0
Jenkins » Matrix Authorization Strategy » Version: 3.0.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.0.1
Jenkins » Matrix Authorization Strategy » Version: 3.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1
Jenkins » Matrix Authorization Strategy » Version: 3.1.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.1
Jenkins » Matrix Authorization Strategy » Version: 3.1.10

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.10
Jenkins » Matrix Authorization Strategy » Version: 3.1.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.2
Jenkins » Matrix Authorization Strategy » Version: 3.1.3

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.3
Jenkins » Matrix Authorization Strategy » Version: 3.1.4

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.4
Jenkins » Matrix Authorization Strategy » Version: 3.1.5

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.5
Jenkins » Matrix Authorization Strategy » Version: 3.1.6

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.6
Jenkins » Matrix Authorization Strategy » Version: 3.1.7

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.7
Jenkins » Matrix Authorization Strategy » Version: 3.1.8

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.8
Jenkins » Matrix Authorization Strategy » Version: 3.1.9

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.1.9
Jenkins » Matrix Authorization Strategy » Version: 3.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2
Jenkins » Matrix Authorization Strategy » Version: 3.2.1

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.1
Jenkins » Matrix Authorization Strategy » Version: 3.2.2

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.2
Jenkins » Matrix Authorization Strategy » Version: 3.2.3

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.3
Jenkins » Matrix Authorization Strategy » Version: 3.2.4

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.4
Jenkins » Matrix Authorization Strategy » Version: 3.2.5

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.5
Jenkins » Matrix Authorization Strategy » Version: 3.2.6

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.6
Jenkins » Matrix Authorization Strategy » Version: 3.2.7

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.7
Jenkins » Matrix Authorization Strategy » Version: 3.2.8

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.8
Jenkins » Matrix Authorization Strategy » Version: 3.2.9

cpe:2.3:a:jenkins:matrix_authorization_strategy:3.2.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-42521

Products

Pricing

Contact Us