CVE-2026-84646: Jenkins Jenkins vulnerability
Published Sep 2, 2026
·Updated
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.
Affected Software
1 affected component
Jenkins Jenkins>2.0<=2.579, <=2.568.2
Event History
Sep 2, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Overall/Read permission in Jenkins and must be able to submit crafted XML that is deserialized by the affected instance.
2
Which Jenkins releases are affected?
Jenkins 2.579 and earlier are affected, as are Jenkins LTS 2.568.2 and earlier.
3
What is the impact of successful exploitation?
A successful attacker can cause Jenkins to create user objects by placing user objects as nested field values in crafted deserialized XML objects.