CVE-2026-84649: CSRF
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 (both inclusive), except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must be able to control a page hosted on the same site as the Jenkins instance. They can then target a user who has an active Jenkins session.
What does an attacker need to obtain before acting as the targeted user?
The attacker needs to retrieve a valid CSRF crumb for the targeted user's session from the affected dynamically generated JavaScript endpoint. The exposed crumb can be used to perform actions on that user's behalf.
Which installations should be treated as affected?
Affected Stapler versions are 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, inclusive, except 2088.2093.vd7c3e58008a_6. These versions are included in Jenkins 2.447 through 2.579 and LTS 2.452.1 through 2.568.2, inclusive.