CVE-2026-84655: Vulnerability in Jenkins Project Jenkins

CVE-2026-84655 is a vulnerability in Jenkins that affects versions 2.579 and earlier, including LTS 2.568.2 and earlier. The issue arises because Jenkins does not escape map keys properly when serializing objects as JSON and Python via its REST API. This improper escaping allows attackers who can control the map property names to inject arbitrary fields into the API responses, potentially leading to data integrity issues or unexpected behavior in clients consuming these responses. The vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output).

The vulnerability allows attackers with the ability to control map property names in API requests to inject arbitrary fields into JSON and Python API responses. This could lead to information manipulation or integrity issues in the API responses. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when exposing the REST API to untrusted users or networks. Restrict access to the API to trusted parties and monitor for unusual API usage patterns.