CVE-2026-84664: Vulnerability in Jenkins Project Jenkins GitLab Plugin

CVE-2026-84664 affects Jenkins GitLab Plugin versions 1.9.16 and earlier. The vulnerability arises from improper handling of Stapler data binding, which permits an attacker with some privileges to overwrite the global GitLab connection configuration. This can lead to the Jenkins instance connecting to a malicious URL using existing GitLab API tokens configured by administrators, potentially exposing sensitive information or enabling unauthorized actions through the GitLab API. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact.

An attacker with limited privileges can overwrite the global GitLab connection configuration, causing Jenkins to connect to attacker-specified URLs using legitimate GitLab API tokens. This can lead to unauthorized access or manipulation of GitLab resources accessible via those tokens. The impact is limited to confidentiality and integrity with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Jenkins GitLab Plugin configuration to trusted administrators only and monitor for suspicious configuration changes. Avoid using GitLab API tokens with excessive privileges in Jenkins configurations.