CVE-2026-84652: Jenkins Jenkins vulnerability
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkinsto a version that resolves this vulnerability.Fixed in 2.579 - Upgrade
Upgrade
Jenkins LTSto a version that resolves this vulnerability.Fixed in 2.568.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Jenkins instances running version 2.579 or earlier, or Jenkins LTS 2.568.2 or earlier, are affected. Exploitation also requires an attacker to be able to serve content on the same site as the Jenkins instance.
What must happen for an attacker to gain access?
The attacker must set a session cookie with a value they know in the victim's browser. If the victim later authenticates using a "remember me" cookie, Jenkins does not rotate that session, allowing the attacker to use the known session as the victim.
How can I tell whether this affects my authentication flow?
The described vulnerable flow specifically involves users being authenticated through Jenkins' "remember me" cookie. Review whether affected Jenkins instances allow or have users relying on remember-me authentication, in addition to checking the installed version.