CVE-2026-84652: Vulnerability in Jenkins Project Jenkins

CVE-2026-84652 describes a session fixation vulnerability in Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier. The issue arises because Jenkins does not rotate the session identifier when a user authenticates via the "remember me" cookie. An attacker capable of serving content on the same site can set a predetermined session cookie in the victim's browser. After the victim logs in with the "remember me" feature, the attacker can use the known session cookie to access Jenkins with the victim's privileges.

Successful exploitation allows an attacker to hijack a user's session by fixing the session ID before authentication via the "remember me" cookie. This results in unauthorized access to Jenkins with the victim's user privileges, potentially exposing sensitive project and build information. The vulnerability does not affect availability but compromises confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the "remember me" feature or restricting access to trusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.