CVE-2026-84647: Vulnerability in Jenkins Project Jenkins

This vulnerability exists in the Stapler framework used by Jenkins, where it fails to restrict the types of objects instantiated via form data binding to those compatible with the expected field type. This flaw permits attackers who have Overall/Read permission to instantiate configuration-related object types that the field type was not intended to allow, enabling unauthorized configuration changes or code execution. The affected versions include Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6), which are included in Jenkins 2.579 and earlier, and Jenkins LTS 2.568.2 and earlier.

Successful exploitation can lead to full compromise of the Jenkins server, including complete loss of confidentiality, integrity, and availability. Attackers with only Overall/Read permission can escalate privileges by instantiating unauthorized configuration objects, potentially leading to remote code execution or other critical impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, restrict access to Jenkins to trusted users only and limit Overall/Read permissions to minimize exposure.