Jenkins 2.579/LTS 2.568.2 RCE via Stapler in config.xml (nested objects)
CVE-2026-84645 Published on September 2, 2026
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.
Vulnerability Analysis
CVE-2026-84645 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-84645 has been classified to as a Code Injection vulnerability or weakness.
What is a Mass Assignment Vulnerability?
The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CVE-2026-84645 has been classified to as a Mass Assignment vulnerability or weakness.
Products Associated with CVE-2026-84645
Want to know whenever a new CVE is published for Jenkins? stack.watch will email you.
Affected Versions
Jenkins Project Jenkins:- Version 2.580 and below * is unaffected.
- Version 2.568.3 and below 2.568.* is unaffected.