CVE-2026-84668 in SAML Plugin
Summary
by MITRE • 09/02/2026
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Jenkins SAML Plugin version 4.618.v441a_27fa_46d2 and earlier contains a critical security vulnerability rooted in improper validation of data binding inputs within the Stapler web framework integration. This flaw allows an authenticated attacker with administrative privileges to overwrite the Security Assertion Markup Language identity provider metadata file through manipulated HTTP requests that exploit the automatic mapping of request parameters to object properties. The underlying technical issue stems from the lack of strict type checking and path traversal prevention when handling files uploaded or modified via Stapler data binding mechanisms, which are commonly used for configuration updates in Jenkins plugins.
This vulnerability enables an attacker to replace the legitimate identity provider metadata with malicious content crafted by the adversary. By injecting a custom XML file containing forged SAML assertions, the attacker can manipulate the authentication flow of the Jenkins instance. When users attempt to log in using Single Sign-On via SAML, the compromised plugin processes the attacker-controlled metadata and issues valid authentication tokens for any user identity specified within those assertions. This effectively bypasses all external authentication controls established by the organization's identity provider, granting unauthorized access to sensitive systems and data hosted on Jenkins.
The operational impact of this vulnerability is severe as it compromises the integrity of the entire authentication infrastructure dependent on SAML integration. Administrators relying on centralized identity management for access control find their security perimeter breached without requiring privilege escalation beyond existing administrative rights. Attackers can impersonate any user, including super-administrators, to execute arbitrary code, modify build configurations, steal credentials stored in Jenkins credential stores, or disrupt continuous delivery pipelines. This undermines the trust model of enterprise CI/CD environments where automated processes often run with elevated privileges and access to production artifacts.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) when considering the potential for remote code execution through compromised build jobs, but more accurately maps to CWE-200 Information Exposure or CWE-613 Insufficient Session Expiration depending on specific exploitation scenarios. In terms of MITRE ATT&CK framework tactics, this falls under Initial Access via Valid Accounts and Defense Evasion by manipulating authentication mechanisms. The attack vector leverages the Trusted Relationship between Jenkins and its identity provider to establish persistence and lateral movement within the organization's network infrastructure.
Mitigation strategies require immediate action from system administrators responsible for maintaining Jenkins instances utilizing affected plugin versions. The primary remediation is upgrading the SAML Plugin to version 4.618.v441a_27fa_46d3 or later, where developers have implemented stricter input validation and restricted Stapler data binding operations on sensitive configuration files. Organizations should also audit their Jenkins configurations for any signs of unauthorized metadata file modifications by checking timestamps and content hashes against known good baselines. Implementing network segmentation to restrict access to the Jenkins management interface from untrusted networks adds an additional layer of defense, reducing the attack surface available to potential adversaries seeking to exploit this configuration flaw.