CVE-2026-84645 Jenkins Project CVE debrief

Who should care

Defenders responsible for Jenkins instances, especially those with internet-exposed web interfaces, should assess exposure and apply remediation to prevent potential unauthorized access and modification of instance configurations. This includes verifying Jenkins instance exposure, restricting access to Jenkins web interfaces, and monitoring Jenkins instance logs for suspicious activity.

Why it matters

CVE-2026-84645 is a high-severity vulnerability in Jenkins that allows for remote code execution via Stapler. Defenders responsible for Jenkins instances, especially those with internet-exposed web interfaces, should assess exposure and apply remediation to prevent potential unauthorized access and modification of instance configurations.

• Remote code execution via Stapler
• Potential for unauthorized access and modification of Jenkins instance configurations
• Need for verification of Jenkins instance exposure and application of remediation

Technical summary

The vulnerability in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, allows objects of types marked as storing their configuration in independent top-level configuration files in Jenkins to appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution. This can lead to potential unauthorized access and modification of Jenkins instance configurations. Defenders should prioritize verifying exposure and applying remediation for Jenkins instances, especially those with internet-exposed web interfaces.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation for Jenkins instances, especially those with internet-exposed web interfaces.

Recommended defensive actions

• Verify Jenkins instance exposure and apply remediation
• Restrict access to Jenkins web interfaces
• Monitor Jenkins instance logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, which allows for remote code execution via Stapler. The vulnerability is caused by objects of types marked as storing their configuration in independent top-level configuration files in Jenkins appearing as nested field values in user-submitted `config.xml` documents and subsequently handling HTTP requests via Stapler.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.