CVE-2026-84645 in Jenkins
Summary
by MITRE • 09/02/2026
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Jenkins versions 2.579 and earlier, including LTS release 2.568.2 and prior iterations, represents a critical security flaw rooted in the improper handling of configuration serialization within the application's request processing pipeline. This issue specifically affects objects that are designated to store their configuration data in independent top-level files rather than being embedded directly within parent structures. The core technical failure lies in how Jenkins processes user-submitted config.xml documents through its Stapler web framework, which serves as the primary HTTP request handler for managing administrative and job configurations. When an attacker submits a maliciously crafted XML document containing nested references to these specific object types, the system fails to adequately validate or restrict the depth of nesting allowed during deserialization and configuration loading processes.
This architectural oversight allows an adversary to inject deeply nested field values that reference global configuration objects or individual job definitions within their own submitted payload. Because Stapler automatically binds incoming HTTP request parameters to Java bean properties based on XML structure, this improper validation enables the attacker to manipulate internal state variables of critical system components. The consequence of this manipulation is severe, as it permits remote code execution with the privileges of the Jenkins process itself. By exploiting this flaw, a malicious actor can execute arbitrary commands on the host machine running Jenkins, effectively gaining full control over the continuous integration and delivery environment without requiring prior authentication if exposed to untrusted networks or through other authenticated vectors that allow configuration submission.
From an industry standard perspective, this vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data, as well as CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component, due to the injection of malicious structural elements into XML processing logic. In terms of tactical classification under MITRE ATT&CK, this exploit falls under T1059 Command and Scripting Interpreter for execution methods and potentially relates to T1136 Creation of Account if new administrative privileges are established during exploitation. The attack vector primarily involves network-based interaction via HTTP/HTTPS protocols targeting the Jenkins management interface, classifying it as a remote code execution vulnerability that can be exploited over the network with low complexity once access is gained or if exposed publicly without proper authentication controls.
The operational impact of this vulnerability extends beyond simple system compromise to include potential lateral movement within internal networks where Jenkins servers reside. Since Jenkins often has access to build agents, source repositories, and deployment pipelines, an attacker leveraging this remote code execution can pivot to other systems, exfiltrate sensitive intellectual property, or disrupt critical software delivery workflows. The persistence of such a vulnerability in long-term support releases highlights the importance of rigorous input validation and strict adherence to safe deserialization practices within enterprise-grade DevOps tools. Organizations must recognize that configuration files are not merely passive data stores but active components processed by complex frameworks like Stapler, requiring robust sanitization layers before any user-supplied XML is parsed into internal object models.
Mitigation strategies for this vulnerability involve immediate upgrading to Jenkins version 2.580 or later and LTS version 2.569.1 or newer, where the underlying serialization logic has been patched to prevent the problematic nesting behavior. For environments unable to upgrade immediately due to compatibility constraints with plugins or custom scripts, administrators should implement strict network segmentation to restrict access to Jenkins endpoints only from trusted IP ranges using reverse proxies with Web Application Firewall rules that inspect XML payloads for excessive nesting depth or known malicious patterns associated with Stapler exploitation techniques. Additionally enabling the Disable CSRF Protection bypass if not already active and ensuring that all administrative interfaces are protected by strong multi-factor authentication can reduce the attack surface significantly while patching efforts proceed across the infrastructure fleet.