CVE-2026-84649 Jenkins Project CVE debrief

Who should care

Jenkins administrators, users with Stapler plugin installed, security teams responsible for monitoring and mitigating vulnerabilities in Jenkins environments, and operators of Jenkins instances should be aware of this vulnerability. They should verify affected versions, apply patches or workarounds, and implement compensating controls to mitigate potential attacks. Vulnerability management and security teams should prioritize this issue due to its high severity and potential impact on Jenkins environments.

Technical summary

The Stapler plugin in Jenkins, versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (excluding 2088.2093.vd7c3e58008a_6), embeds the user's CSRF token as a string literal in an HTTP endpoint serving dynamically generated JavaScript resources. This allows attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf. The vulnerability has a high CVSS score of 8.8, indicating a high severity level.

Defensive priority

High-priority defensive actions are required due to the high CVSS score of 8.8 and the potential for attackers to obtain a valid crumb for the targeted user's session.

Recommended defensive actions

• Inventory and verify affected Jenkins versions and Stapler plugin versions.
• Apply vendor remediation or patches for the affected versions.
• Implement compensating controls, such as monitoring for suspicious activity.
• Restrict access to the affected HTTP endpoint.
• Consider exception tracking for potential bypasses.

Evidence notes

Evidence is based on the CVE Program record and the NVD vulnerability detail page. The CVE description indicates that an HTTP endpoint in Stapler, included in Jenkins, embeds the user's CSRF token as a string literal, allowing attackers to obtain a valid crumb for the targeted user's session. Defenders should verify affected Jenkins versions, Stapler plugin versions, and implement compensating controls. Evidence limits suggest focusing on publicly available information and vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.