Live › vulnerability › CVE-2018-1000861
Go to dashboardThe Stapler web framework used by Jenkins deserializes untrusted data, letting a remote request run code. An attacker who can reach the Jenkins web interface gets code execution on the Jenkins server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Jenkins Jenkins Stapler Web Framework | vendor | – | – |
Unknown from the sources.
Apply the Jenkins and Stapler updates from the vendor advisory; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
This page as .md · .json · in your agent: get_signal("CVE-2018-1000861")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.