← Vulnerability feed

Vulnerability record · CVE-2018-1000861 · published 10 December 2018

CVE-2018-1000861: Jenkins Stapler framework URL routing allows remote code execution

Jenkins · Jenkins

The Stapler web framework in Jenkins 2.153 and earlier and LTS 2.138.3 and earlier lets attackers invoke unintended Java methods by requesting crafted URLs. Because the exposed methods can lead to code execution, an unauthenticated network attacker can take over the Jenkins controller.

9.8 CVSS 3.1 Critical CISA KEV since 10 Feb 2022 EPSS 98% · top 0.1% CWE-502 · Deserialization of untrusted data
9.8CVSS 3.1 base score, v2 10.0
98%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
2Affected product versions listed by NVD
9References
17 Jun 2026Last modified by NVD

Description

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, KEV listing, and near-certain EPSS probability make this an actively exploited remote code execution flaw in an internet-facing service.

What it is

The Stapler web framework in Jenkins 2.153 and earlier and LTS 2.138.3 and earlier lets attackers invoke unintended Java methods by requesting crafted URLs. Because the exposed methods can lead to code execution, an unauthenticated network attacker can take over the Jenkins controller.

Impact

An attacker gains remote code execution on the Jenkins controller, which typically yields access to credentials, build jobs, and any systems the controller can reach.

Attack surface

Reachable over the network via HTTP requests to the Jenkins web interface; the CVSS vector shows no privileges or user interaction required, and the description confirms crafted URLs are the trigger.

Exploitation

CVE-2018-1000861 is listed in CISA KEV with a 2022-02-10 addition date, and EPSS reports a 30-day probability of 0.98326 (99.9th percentile), indicating active exploitation and very high likelihood.

What to do

  • Upgrade Jenkins to a version later than 2.153 or LTS 2.138.3 per the vendor advisory SECURITY-595.
  • If immediate upgrade is not possible, restrict network access to the Jenkins web interface to trusted management networks only.
  • Apply the referenced Red Hat errata for OpenShift Container Platform where Jenkins is bundled.
  • Review Jenkins controller credentials and secrets for exposure and rotate them after patching.
  • Disable or remove unused Jenkins plugins and endpoints that expand the Stapler routing surface.

Detection

  • Monitor Jenkins HTTP access logs for unusual or crafted URL paths that map to unexpected Java method invocations.
  • Alert on outbound connections or process execution from the Jenkins controller host that do not match normal build activity.
  • Hunt for known exploitation artifacts referenced in public advisories and packetstorm write-ups against Jenkins controllers.
  • Correlate Jenkins controller authentication and job configuration changes with anomalous request patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2018-1000861 to the Known Exploited Vulnerabilities catalog on 10 February 2022 as "Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 10 August 2022.

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/106176 Broken Link
https://access.redhat.com/errata/RHBA-2019:0024 Third Party Advisory
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595 Vendor Advisory
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/106176 Broken Link
https://access.redhat.com/errata/RHBA-2019:0024 Third Party Advisory
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861 US Government Resource

Track CVE-2018-1000861 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-7609Kibana Timelion visualizer code injection enables remote code executionKibana before 5.6.15 and 6.6.1 contains an arbitrary code execution flaw in the Timelion visualizer. An attacker who can reach the Timelion applicati…KEVEPSS 95%analysed9.9CVE-2019-1003029Jenkins Script Security Plugin sandbox bypass allows code executionThe Jenkins Script Security Plugin 1.53 and earlier fails to properly enforce its Groovy sandbox in GroovySandbox.java and SecureGroovyScript.java, l…KEVEPSS 74%analysed9.9CVE-2019-1003030Jenkins Pipeline Groovy Plugin sandbox bypass allows arbitrary code executionThe Jenkins Pipeline: Groovy Plugin (2.63 and earlier) contains a sandbox bypass in CpsGroovyShell.java. Attackers who can control pipeline scripts c…KEVEPSS 97%analysed9.8CVE-2024-23897Jenkins CLI parser arbitrary file read via @ path expansionJenkins 2.441 and earlier, and LTS 2.426.2 and earlier, fails to disable a CLI command parser feature that replaces an '@' character followed by a fi…KEVEPSS 100%analysed9.8CVE-2017-1000353Jenkins CLI Java deserialization allows unauthenticated remote code executionJenkins 2.56 and earlier, and 2.46.1 LTS and earlier, deserialize attacker-supplied Java SignedObject data sent to the Jenkins CLI, bypassing the exi…KEVEPSS 100%analysed7.8CVE-2026-31431Linux kernel algif_aead in-place crypto operation flawThe Linux kernel's algif_aead AF_ALG AEAD interface operated in-place on buffers that come from different mappings, a flaw the fix resolves by revert…KEVEPSS 3.4%analysed7.8CVE-2021-3560polkit D-Bus credential check bypass allows local root escalationpolkit can be tricked into bypassing credential checks for D-Bus requests, letting an unprivileged local user elevate to root. Because polkit is a co…KEVEPSS 24%analysed7.8CVE-2019-0211Apache HTTP Server scoreboard use-after-free local privilege escalationApache HTTP Server 2.4.17 through 2.4.38 with MPM event, worker or prefork contains a use-after-free in scoreboard handling. Code running in a less-p…KEVEPSS 65%analysed

Source: NIST National Vulnerability Database (record CVE-2018-1000861), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.