CVE-2026-84656: Vulnerability in Jenkins Project Jenkins

This vulnerability in Jenkins arises from a missing permission check in versions 2.579 and earlier (including LTS 2.568.2 and earlier). An attacker who has Item/Read permission on at least one job can exploit this flaw to read build parameter names and values of other jobs for which they lack access permissions. The issue is categorized under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3 (medium severity), reflecting low confidentiality impact with no integrity or availability impact. No official patch or remediation level has been provided in the available data, and no known exploits are reported in the wild.

The vulnerability allows unauthorized disclosure of build parameter names and values from Jenkins jobs that the attacker should not have access to. This could expose sensitive information configured as build parameters. There is no impact on integrity or availability according to the CVSS vector. The attack requires the attacker to have at least Item/Read permission on one job, which is a prerequisite for exploitation.

Patch status is not yet confirmed — check the Jenkins vendor advisory for current remediation guidance. Until an official fix is available, review and restrict Item/Read permissions carefully to limit exposure. No vendor advisory or official fix information is currently provided.