CVE-2026-84651: Vulnerability in Jenkins Project Jenkins
Description
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.
CVSS v3.1
Score 6.3medium
Affected software
Jenkins Project
Jenkins
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84651 affects Jenkins versions 2.579 and earlier, including LTS 2.568.2 and earlier. The flaw exists in the REST API and CLI endpoints used to update agent configurations. These endpoints do not properly restrict submitted XML configurations from specifying a different agent's name, allowing an attacker with Agent/Configure permission on one agent to overwrite another agent's configuration. This leads to unauthorized control over the targeted agent's configuration and exposure of its inbound agent secret and environment variables.
Potential Impact
An attacker with Agent/Configure permission on one Jenkins agent can escalate privileges by taking over the configuration of a different agent. This can result in unauthorized access to sensitive secrets and environment variables associated with the targeted agent, potentially leading to further compromise within the Jenkins environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Agent/Configure permissions to trusted users only to minimize risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jenkins
- Date Reserved
- 2026-09-01T21:55:27.033Z
- State
- PUBLISHED
Threat ID: 6a984662acd9273b496cc3c8
Added to database: 09/02/2026, 15:53:06 UTC
Last enriched: 09/07/2026, 21:07:58 UTC
Last updated: 10/16/2026, 06:48:19 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.