CVE-2026-84667: Security vulnerability
Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins ThinBackup Pluginto a version that resolves this vulnerability.Fixed in 2.1.4 - Compensating control
If ThinBackup Plugin versions at or below 2.1.4 are still in use, restrict access to Jenkins endpoints that could be targeted via Stapler data binding (e.g., limit who can reach/trigger ThinBackup configuration endpoints to trusted admins only) until the plugin is upgraded.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can submit requests that reach the plugin's Stapler data-binding functionality can overwrite the ThinBackup backup configuration. The provided information does not specify required Jenkins permissions or whether unauthenticated access is sufficient.
What impact can an attacker achieve through the altered backup configuration?
They can redirect backup writes to an attacker-specified directory and cause backups to include arbitrary files from the Jenkins controller file system.
Which installations are identified as affected?
Jenkins installations using ThinBackup Plugin version 2.1.4 or earlier are affected. The provided information does not state whether any particular default configuration changes exploitability.