{"id":"CVE-2026-42521","details":"Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.","aliases":["GHSA-jp9r-mmhw-vff3"],"modified":"2026-07-08T08:13:24.743228783Z","published":"2026-04-29T14:16:19.170Z","related":["CGA-xf72-2f4w-2m5x"],"database_specific":{"unresolved_ranges":[{"vendor_product":"jenkins:matrix_authorization_strategy","cpes":["cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta1:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta2:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:matrix_authorization_strategy:2.0:beta3:*:*:*:jenkins:*:*"],"extracted_events":[{"introduced":"2.0-beta1"},{"last_affected":"2.0-beta1"},{"introduced":"2.0-beta2"},{"last_affected":"2.0-beta2"},{"introduced":"2.0-beta3"},{"last_affected":"2.0-beta3"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3676"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/matrix-auth-plugin","events":[{"introduced":"44a577a8208ede02d6d20fe0aa6ba8c2ad7efc7b"},{"fixed":"b3f7342c0fae5a81afe3e18f86f1633695e8cd82"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:matrix_authorization_strategy:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"2.1"},{"fixed":"3.2.10"}],"source":"CPE_RANGE"}}],"versions":["matrix-auth-3.2.9","matrix-auth-3.2.8","matrix-auth-3.2.7","matrix-auth-3.2.6","matrix-auth-3.2.5","matrix-auth-3.2.4","matrix-auth-3.2.3","matrix-auth-3.2.2","matrix-auth-3.2.1","matrix-auth-3.2","matrix-auth-3.1.10","matrix-auth-3.1.9","matrix-auth-3.1.8","matrix-auth-3.1.7","matrix-auth-3.1.6","matrix-auth-3.1.5","matrix-auth-3.1.4","matrix-auth-3.1.3","matrix-auth-3.1.2","matrix-auth-3.1.1","matrix-auth-3.1","matrix-auth-3.0.1","matrix-auth-3.0","matrix-auth-2.6.11","matrix-auth-2.6.10","matrix-auth-2.6.9","matrix-auth-2.6.8","matrix-auth-2.6.7","matrix-auth-2.6.6","matrix-auth-2.6.5","matrix-auth-2.6.4","matrix-auth-2.6.3","matrix-auth-2.6.2","matrix-auth-2.6.1","matrix-auth-2.6","matrix-auth-2.5","matrix-auth-2.4.2","matrix-auth-2.4.1","matrix-auth-2.4","matrix-auth-2.3","matrix-auth-2.2","matrix-auth-2.1.1","matrix-auth-2.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42521.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}