CVE-2026-84665 Jenkins Project CVE debrief

Who should care

Administrators of Jenkins instances using the SonarQube Scanner Plugin, especially those with Item/Configure permission, should be aware of this vulnerability and take necessary actions to mitigate it. Additionally, security teams and vulnerability management teams should review the vulnerability's impact on their organization's Jenkins deployments and prioritize patching or mitigation efforts accordingly. Operators and platform administrators may also need to review the vulnerability's impact on their specific environments and take action to protect against potential attacks.

Technical summary

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for dashboard links created based on SonarQube scanner results, allowing the `javascript:` scheme. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. The vulnerability's technical impact is significant due to the potential for attackers to inject malicious scripts, but its operational impact may vary depending on the specific Jenkins instance configuration and usage.

Defensive priority

Administrators should prioritize patching Jenkins SonarQube Scanner Plugin 2.18.3 or earlier due to the HIGH CVSS score of 8 and the potential for stored cross-site scripting (XSS) attacks.

Recommended defensive actions

• Patch Jenkins SonarQube Scanner Plugin to the latest version
• Restrict Item/Configure permission to trusted users
• Monitor Jenkins instance for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide evidence of a stored cross-site scripting (XSS) vulnerability in Jenkins SonarQube Scanner Plugin 2.18.3 and earlier. The vulnerability allows attackers with Item/Configure permission to inject malicious scripts via the `javascript:` scheme in dashboard links. Evidence is limited, and defenders should verify the vulnerability's existence and scope within their environments. Additional review of Jenkins security advisories and SonarQube scanner results may be necessary to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.