CVE-2026-84646: Jenkins XXE Vulnerability via XML Parsing

CVE-2026-84646 Overview

CVE-2026-84646 affects Jenkins 2.579 and earlier, and Jenkins LTS 2.568.2 and earlier. The vulnerability allows authenticated attackers with Overall/Read permission to create user objects by submitting crafted XML payloads. User objects can appear as nested field values in other deserialized XML objects, enabling unauthorized user creation through XML deserialization.

The root weakness is classified as [CWE-502] Deserialization of Untrusted Data. Successful exploitation compromises integrity of the Jenkins user database without requiring administrator privileges.

Critical Impact
Authenticated users with Overall/Read permission can create arbitrary user objects in Jenkins, potentially enabling persistence and follow-on attacks against the automation server.

Affected Products

Jenkins 2.579 and earlier
Jenkins LTS 2.568.2 and earlier
Jenkins core XML deserialization component

Discovery Timeline

2026-09-02 - CVE-2026-84646 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-3908 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84646

Vulnerability Analysis

Jenkins uses XML serialization to persist and transport configuration and object state. The vulnerable code path permits User objects to appear as nested field values inside other deserialized XML objects. When Jenkins processes crafted XML from an authenticated caller, it instantiates the nested User objects as a side effect of deserialization.

This behavior effectively converts a read-scoped API surface into a limited write primitive against the Jenkins user database. An attacker holding only Overall/Read permission can populate the user directory with attacker-chosen identifiers.

While the vulnerability itself does not grant code execution or credential access, unauthorized user creation supports account squatting, log poisoning, and staging conditions for chained vulnerabilities affecting the Jenkins identity model.

Root Cause

The root cause is unsafe handling of nested types during XML deserialization. Jenkins does not restrict which classes may be instantiated when they appear as nested field values, allowing User object construction outside of the intended user management flow. This is a classic insecure deserialization pattern where object type is not constrained to a safe allow-list.

Attack Vector

Exploitation requires network access to the Jenkins controller and an authenticated account with Overall/Read permission. The attacker submits an HTTP request containing crafted XML that includes a nested User field. Jenkins deserializes the payload and creates the user object as a side effect. No user interaction is required.

Refer to the Jenkins Security Advisory SECURITY-3908 for authoritative technical details.

Detection Methods for CVE-2026-84646

Indicators of Compromise

Creation of Jenkins user accounts that do not correspond to a legitimate administrative action or SSO provisioning event
New entries appearing under the Jenkins users/ directory on the controller filesystem without matching audit trail records
HTTP requests to Jenkins endpoints containing XML payloads with unexpected nested User elements

Detection Strategies

Audit the Jenkins user list against the authoritative identity source and flag any account not provisioned through the sanctioned workflow
Enable and review Jenkins audit logs for unexpected user creation events correlated with low-privilege sessions holding only Overall/Read
Inspect reverse proxy or WAF logs for POST/PUT traffic to Jenkins containing XML bodies referencing hudson.model.User or nested user fields

Monitoring Recommendations

Alert on any change to the $JENKINS_HOME/users/ directory outside of scheduled administrative windows
Baseline the number of Jenkins accounts and alert on deviation, particularly account additions initiated by non-administrator sessions
Forward Jenkins access and audit logs to a central log platform and correlate authentication context with user-management events

How to Mitigate CVE-2026-84646

Immediate Actions Required

Upgrade Jenkins weekly to version 2.580 or later, and Jenkins LTS to 2.568.3 or later, as directed by the vendor advisory
Review existing Jenkins users and remove any accounts that cannot be tied to a legitimate provisioning event
Restrict Overall/Read permission to trusted principals and audit anonymous or authenticated-user grants

Patch Information

Jenkins has published fixes through the Jenkins Security Advisory SECURITY-3908. Apply the vendor-supplied updates to Jenkins core. Plugin updates are not required for this specific issue, but administrators should review the full advisory for related fixes released on the same date.

Workarounds

No official workaround is documented by the vendor; upgrading is the supported remediation
Reduce exposure by placing the Jenkins controller behind an authenticated reverse proxy and limiting network reachability to trusted CI/CD networks
Remove Overall/Read grants from anonymous and broadly scoped authenticated groups until the patch is applied

bash

# Verify installed Jenkins version and locate user directory for audit
java -jar jenkins.war --version
ls -la $JENKINS_HOME/users/