Description
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | jenkins | 2.138.4.1544416383-1.el7 | RHBA-2019:0024 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Jenkins ACL Bypass and Metaprogramming RCE
exploit/multi/http/jenkins_metaprogramming
GitHub 3 repositories
-
1NTheKut/CVE-2019-1003000_RCE-DETECTION ★ 4 · Apr 24, 2019
A C# module to detect if a Jenkins server is vulnerable to the RCE vulnerability found in CVE-2019-1003000 (chained with CVE-2018-1000861 for pre-auth RCE)
-
CyberCTF/vulhub-jenkins-cve-2018-1000861 ★ 0 · Oct 8, 2026
Vulhub jenkins/CVE-2018-1000861: Jenkins Stapler unauthenticated RCE, run with Isoloom
-
smokeintheshell/CVE-2018-1000861 ★ 0 · Sep 13, 2023
CVE-2018-1000861 Exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jenkins - Remote Command Injection http/cves/2018/CVE-2018-1000861.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.138.4 | 2.138.4 | GHSA-hhpm-5cp2-hg4x |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.140, < 2.154 | 2.154 | GHSA-hhpm-5cp2-hg4x |
Advisories 1
- RHBA-2019:0024 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jan 14, 2026