CVE-2026-84655: Jenkins Jenkins vulnerability
Published Sep 2, 2026
·Updated
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.
Affected Software
1 affected component
Jenkins Jenkins<=2.579, <=2.568.2
Event History
Sep 2, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Data Sourced
via NVD·04:17 PM
Description
Frequently Asked Questions
1
Which Jenkins installations are affected?
Jenkins 2.579 and earlier, and Jenkins LTS 2.568.2 and earlier, are affected.
2
What access or control does an attacker need to exploit this issue?
The attacker must be able to control map property names that Jenkins serializes through its REST API.
3
What can exploitation change in API output?
An attacker can inject arbitrary fields into JSON and Python responses produced by the Jenkins REST API.