CVE-2026-84650: Jenkins Jenkins vulnerability
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkinsto a version that resolves this vulnerability.Fixed in 2.579 - Upgrade
Upgrade
Jenkins LTSto a version that resolves this vulnerability.Fixed in 2.568.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to submit Jenkins configuration updates. The impact depends on how affected transient fields are used after they are deserialized.
Which Jenkins releases are affected?
Jenkins 2.579 and earlier are affected, as are Jenkins LTS 2.568.2 and earlier.
Are configurations that use transient fields at risk?
Affected Jenkins versions allow transient fields to be assigned values through deserialization even when those fields are intended to be excluded. Whether this produces a security impact depends on the use of those fields.