CVE-2026-84654: Stapler vulnerability
In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Staplerto a version that resolves this vulnerability.Fixed in 2107.v8dfcb_e8ed317 - Upgrade
Upgrade
Jenkins Staplerto a version that resolves this vulnerability.Fixed in 2088.2093.vd7c3e58008a_6 - Upgrade
Upgrade
Jenkinsto a version that resolves this vulnerability.Fixed in 2.579 - Upgrade
Upgrade
Jenkins LTSto a version that resolves this vulnerability.Fixed in 2.568.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to submit Jenkins configuration forms that bind to a vulnerable configuration object. The impact is limited to public static fields on the configuration objects associated with forms the attacker can access.
What is the practical impact of successful exploitation?
A successful attacker can modify public static fields through form data binding. Because these fields are static, the resulting changes apply globally across the Jenkins instance.
Which versions are affected?
Stapler 2107.v8dfcb_e8ed317 and earlier are affected, except 2088.2093.vd7c3e58008a_6. The issue is included in Jenkins 2.579 and earlier and Jenkins LTS 2.568.2 and earlier.