CVE-2026-84645: Jenkins Jenkins vulnerability
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted config.xml documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.579 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.568.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a way to submit a crafted config.xml document containing affected objects as nested field values. Those objects can then handle HTTP requests through Stapler, leading to remote code execution.
Which Jenkins configuration areas may be involved?
The issue affects objects whose configuration is stored in independent top-level Jenkins configuration files. The global configuration and jobs are identified as examples.