CVE-2026-84652 in Jenkins
Summary
by MITRE • 09/02/2026
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Jenkins versions 2.579 and earlier, including LTS release 2.568.2 and prior iterations, represents a critical authentication bypass mechanism rooted in improper session management practices. Specifically, the flaw lies in the failure to rotate or invalidate existing sessions when a user authenticates using the persistent remember-me cookie feature. In standard secure web application architecture, transitioning from an unauthenticated state to an authenticated state requires generating a new session identifier and discarding any previous identifiers associated with that user account. This process is essential to prevent Session Fixation attacks, where an attacker pre-sets a known session ID for a victim before the victim logs in. By neglecting this rotation step during remember-me authentication, Jenkins inadvertently allows previously established or externally manipulated sessions to remain valid and active after successful login credentials are processed via the persistent cookie mechanism.
The operational impact of this flaw is severe, as it enables attackers who can serve content on the same site as Jenkins to execute a sophisticated session fixation attack. An attacker achieves this by serving malicious content that sets a specific, known session cookie in the victim's browser while they are not yet authenticated or during an earlier unauthenticated interaction with the application. When the victim subsequently authenticates using their remember-me credentials, the system fails to issue a new session token and instead retains the previously set cookie value as the active session identifier for that user account. Consequently, because the attacker already possesses knowledge of this specific session ID due to having served it initially, they can immediately use that same session ID to access Jenkins with full privileges associated with the victim's compromised account. This effectively grants unauthorized administrative or operational control over the CI/CD pipeline without requiring further interaction from the victim beyond their normal authentication routine.
From a technical classification perspective, this vulnerability aligns closely with CWE-384, which describes Session Fixation attacks where an attacker sets or influences a session identifier before the user authenticates. Furthermore, within the context of the MITRE ATT&CK framework, this behavior facilitates techniques associated with Credential Access and Privilege Escalation, specifically leveraging valid credentials obtained through fixation rather than direct theft. The root cause is not necessarily a flaw in the encryption or transmission of data but rather a logical error in state management during the authentication lifecycle. This highlights a common pitfall in web application development where convenience features like persistent login tokens are implemented without adequate safeguards to ensure session integrity upon re-authentication events.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary and most effective mitigation is upgrading Jenkins to version 2.580 or later, as well as LTS versions released after the fix for this issue was applied, where developers have implemented proper session rotation logic during remember-me authentication flows. For environments unable to upgrade immediately due to compatibility constraints, administrators should consider disabling the remember-me functionality entirely if it is not strictly required by their workflow, thereby removing the attack vector associated with persistent cookies. Additionally, enforcing strict SameSite cookie attributes and implementing robust Content Security Policies can help mitigate some aspects of cross-site scripting vectors that might be used in conjunction with this flaw to inject malicious session-setting scripts into victim browsers. Regular security audits focusing on authentication state transitions are also recommended to ensure no other components within the Jenkins ecosystem exhibit similar weaknesses regarding session management integrity.