Jenkins GitLab Plugin <=1.9.16 Global Config Overwrite via Stapler Data Binding
CVE-2026-84664 Published on September 2, 2026

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-84664 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Types

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.

What is a MAID Vulnerability?

The software does not properly protect an assumed-immutable element from being modified by an attacker. This occurs when a particular input is critical enough to the functioning of the application that it should not be modifiable at all, but it is. Certain resources are often assumed to be immutable when they are not, such as hidden form fields in web applications, cookies, and reverse DNS lookups.

CVE-2026-84664 has been classified to as a MAID vulnerability or weakness.


Products Associated with CVE-2026-84664

Want to know whenever a new CVE is published for Jenkins? stack.watch will email you.

Jenkins
 

Affected Versions

Jenkins Project Jenkins GitLab Plugin: