CVE-2026-84645 Overview
CVE-2026-84645 is a remote code execution vulnerability in Jenkins affecting version 2.579 and earlier, and LTS 2.568.2 and earlier. The flaw resides in how Jenkins processes user-submitted config.xml documents through the Stapler web framework. Objects storing their configuration in independent top-level configuration files, such as the global configuration and jobs, can appear as nested field values in config.xml documents. These nested objects subsequently handle HTTP requests via Stapler, enabling authenticated attackers to execute arbitrary code on the Jenkins controller. The vulnerability is classified as [CWE-94] Improper Control of Generation of Code.
Critical Impact
Authenticated attackers can achieve remote code execution on the Jenkins controller by submitting crafted config.xml documents, leading to full compromise of the CI/CD environment.
Affected Products
- Jenkins 2.579 and earlier
- Jenkins LTS 2.568.2 and earlier
- Jenkins controllers exposing job or global configuration endpoints
Discovery Timeline
- 2026-09-02 - CVE-2026-84645 published to NVD
- 2026-09-02 - Jenkins Security Advisory SECURITY-3972 released
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84645
Vulnerability Analysis
Jenkins uses the Stapler web framework to bind HTTP requests to Java objects. Stapler traverses object fields and invokes methods based on URL path segments. Certain object types in Jenkins are designed to persist their configuration in dedicated top-level files rather than as embedded XML. Examples include the global configuration and job objects.
The vulnerability arises because these top-level configuration objects can still be deserialized when they appear as nested field values inside a user-submitted config.xml document. Once instantiated, the nested objects become reachable via Stapler request routing. Attackers can then trigger method invocations that lead to arbitrary code execution on the Jenkins controller.
Exploitation requires authenticated access with permission to submit configuration documents. The attack originates over the network with low complexity and does not require user interaction.
Root Cause
The root cause is missing validation of object types permitted as nested field values within config.xml. Jenkins does not enforce restrictions preventing top-level configuration types from being deserialized in nested contexts. The Stapler dispatcher then treats these objects as valid HTTP request handlers, exposing dangerous methods.
Attack Vector
An authenticated attacker submits a crafted config.xml document containing a nested field referencing a top-level configuration type. Jenkins deserializes the nested object and makes it addressable through Stapler HTTP routing. The attacker issues follow-up HTTP requests that dispatch to methods on the deserialized object, achieving code execution in the context of the Jenkins controller process.
Refer to the Jenkins Security Advisory SECURITY-3972 for technical details.
Detection Methods for CVE-2026-84645
Indicators of Compromise
- Unexpected config.xml POST or PUT requests containing nested object references to global configuration or job types
- Anomalous Stapler URL traversal patterns invoking methods on job or global configuration objects
- New or modified Jenkins jobs, credentials, or plugins created outside of normal change windows
- Outbound network connections from the Jenkins controller to unfamiliar hosts following configuration changes
Detection Strategies
- Monitor Jenkins audit logs for config.xml submissions from non-administrative accounts
- Alert on Stapler request URLs containing unusual nested field traversals or method invocations
- Correlate configuration change events with subsequent process execution on the Jenkins controller
- Inspect HTTP request bodies for XML payloads referencing hudson.model.Hudson, hudson.model.Job, or similar top-level types in nested positions
Monitoring Recommendations
- Enable Jenkins access logging and forward events to a centralized logging platform for retention and analysis
- Track process creation events on the Jenkins controller host, focusing on children of the Jenkins JVM
- Monitor filesystem changes to Jenkins home directories, particularly jobs/, users/, and plugin directories
- Baseline normal Stapler request patterns and alert on deviations
How to Mitigate CVE-2026-84645
Immediate Actions Required
- Upgrade Jenkins to version 2.580 or later, or LTS 2.568.3 or later, as specified in the Jenkins Security Advisory
- Restrict Job/Configure and Overall/Administer permissions to trusted users only
- Review recent config.xml submissions and job configuration changes for signs of exploitation
- Rotate credentials stored in Jenkins if compromise is suspected
Patch Information
Jenkins has released fixed versions addressing CVE-2026-84645. Administrators should apply the update referenced in the Jenkins Security Advisory SECURITY-3972. The patch enforces validation preventing top-level configuration types from being instantiated as nested field values in submitted config.xml documents.
Workarounds
- Limit network access to the Jenkins controller through firewall rules and reverse proxy authentication
- Enforce least privilege on Jenkins role-based access control, removing configuration permissions from non-essential accounts
- Isolate the Jenkins controller on a segmented network and restrict outbound egress
- Monitor and alert on any use of the config.xml API endpoints by non-administrative users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
