CVE-2026-42521

score

<0.1

cvss

6.5

epss

0.4%

published

2026-04-29

kev added

—

first seen

2026-10-21

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 contains an insecure deserialization vulnerability caused by unrestricted instantiation of classes during deserialization of inheritance strategies, letting attackers with Item/Configure permission instantiate arbitrary types, potentially leading to information disclosure or other impacts.