CVE-2026-84654
Published:September 02, 2026
Updated:September 22, 2026
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.
Affected Packages
https://github.com/jenkinsci/stapler.git (GITHUB):
Affected version(s) >=2092.v91b_2c63e0c97 <2117.vb_66952503166Fix Suggestion:
Update to version 2117.vb_66952503166org.jenkins-ci.main:jenkins-core (JAVA):
Affected version(s) >=2.568 <2.568.3Fix Suggestion:
Update to version 2.568.3org.kohsuke.stapler:stapler (JAVA):
Affected version(s) >=2092.v91b_2c63e0c97 <2117.vb_66952503166Fix Suggestion:
Update to version 2117.vb_66952503166org.jenkins-ci.main:jenkins-core (JAVA):
Affected version(s) >=1.396 <2.580Fix Suggestion:
Update to version 2.580Related Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
External Control of Assumed-Immutable Web Parameter
EPSS
Base Score:
0.20