CVE-2026-84658: Vulnerability in Jenkins Project Jenkins Script Security Plugin

CVE-2026-84658 is a medium-severity information disclosure vulnerability in the Jenkins Script Security Plugin. The flaw arises because the plugin uses the @DataBoundConstructor annotation on a constructor responsible for loading script approval configuration. This design allows attackers who can submit certain forms with limited privileges (PR:L) to read sensitive configuration data related to script approvals. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no user interaction required, but limited impact confined to confidentiality. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with low privileges who can submit specific forms to the Jenkins Script Security Plugin can read script approval configuration data. This results in an information disclosure impact (CWE-200) but does not affect integrity or availability. The confidentiality impact is limited, and the vulnerability does not allow code execution or denial of service.

Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until a fix is available, restrict access to Jenkins interfaces to trusted users only and monitor for suspicious form submissions related to script approval configurations.