CVE-2026-84646: Vulnerability in Jenkins Project Jenkins
Description
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.
CVSS v3.1
Score 4.3medium
Affected software
Jenkins Project
Jenkins
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Jenkins versions 2.579 and earlier, including LTS 2.568.2 and earlier. It arises because user objects can appear as nested field values within other deserialized XML objects. An attacker with Overall/Read permission can exploit this by submitting specially crafted XML to create user objects. The issue is categorized under CWE-502 (Deserialization of Untrusted Data). There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.
Potential Impact
An attacker with Overall/Read permission can create user objects by submitting crafted XML. This could lead to unauthorized user object creation, potentially impacting the integrity of the Jenkins environment. The CVSS score is 4.3 (medium severity), indicating limited impact with no confidentiality or availability impact but some integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Overall/Read permissions to trusted users only to reduce risk. Monitor Jenkins updates for a forthcoming patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jenkins
- Date Reserved
- 2026-09-01T21:55:27.033Z
- State
- PUBLISHED
Threat ID: 6a984660acd9273b496cc38a
Added to database: 09/02/2026, 15:53:04 UTC
Last enriched: 09/07/2026, 13:37:31 UTC
Last updated: 10/15/2026, 18:48:24 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.