Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-84649

Jenkins · Vulnerability

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-84649

Published

In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-84649

Published

Jenkins

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "affected",
                    "product": "Jenkins",
                    "vendor": "Jenkins Project",
                    "versions": [
                        {
                            "lessThan": "*",
                            "status": "unaffected",
                            "version": "2.580",
                            "versionType": "maven"
                        },
                        {
                            "lessThan": "2.447",
                            "status": "unaffected",
                            "version": "0",
                            "versionType": "maven"
                        },
                        {
                            "lessThan": "2.568.*",
                            "status": "unaffected",
                            "version": "2.568.3",
                            "versionType": "maven"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON