CVE-2026-84656: Jenkins Jenkins vulnerability
Published Sep 2, 2026
·Updated
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.
Affected Software
1 affected component
Jenkins Jenkins<=2.579, <=2.568.2
Event History
Sep 2, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Item/Read permission on at least one Jenkins job. They can then read build parameter names and values from jobs they are not authorized to access.
2
What information may be exposed?
Build parameter names and values for inaccessible jobs may be disclosed. The available information does not specify which parameter types or values are affected beyond build parameters.
3
Which Jenkins versions are affected?
Jenkins 2.579 and earlier, and Jenkins LTS 2.568.2 and earlier, are affected.