CVE-2026-84654: Vulnerability in Jenkins Project Jenkins

CVE-2026-84654 is a vulnerability in the Stapler framework versions 2107.v8dfcb_e8ed317 and earlier (excluding 2088.2093.vd7c3e58008a_6), which is bundled with Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier. The flaw allows form data binding to set public static fields of the bound configuration object. Attackers who can submit configuration forms may exploit this to modify public static fields, causing changes that affect the entire Jenkins instance globally. This vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter). There is no vendor advisory or patch information provided yet, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with permission to submit configuration forms to modify public static fields of configuration objects, leading to global configuration changes in the Jenkins instance. This can impact confidentiality and integrity but does not affect availability. The CVSS score is 5.4 (medium severity), indicating a moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to configuration forms to trusted users only to reduce the risk of exploitation.