CVE-2026-84649: Vulnerability in Jenkins Project Jenkins

This vulnerability exists in Stapler versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (inclusive), except 2088.2093.vd7c3e58008a_6, which are included in Jenkins 2.447 through 2.579 and LTS 2.452.1 through 2.568.2. The issue is that an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's CSRF token (crumb) as a string literal. An attacker with control over a page hosted on the same Jenkins site can extract this crumb, enabling them to perform actions on behalf of the targeted user by bypassing CSRF protections.

Successful exploitation allows an attacker to bypass CSRF protections by obtaining a valid crumb token for a victim's session. This enables the attacker to perform unauthorized actions with the victim's privileges, potentially leading to full compromise of the Jenkins instance depending on the victim's permissions. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Jenkins instances to trusted users and networks only. Avoid hosting untrusted content on the same site as Jenkins to prevent attackers from controlling pages that could exploit this vulnerability.