CVE-2026-84647: Jenkins Stapler Privilege Escalation Flaw

CVE-2026-84647 Overview

CVE-2026-84647 is a deserialization vulnerability in Stapler, the web framework used by Jenkins. Stapler versions 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6) fail to restrict the object types that can be instantiated via form data binding. Attackers with Overall/Read permission can instantiate configuration-related types that were never intended for the target field. The flaw affects Jenkins 2.579 and earlier, and LTS releases 2.568.2 and earlier. The vulnerability is classified as CWE-502: Deserialization of Untrusted Data.

Critical Impact

Authenticated attackers can abuse form data binding to instantiate arbitrary Stapler-compatible types, exposing confidentiality, integrity, and availability of the Jenkins controller.

Affected Products

• Jenkins weekly 2.579 and earlier
• Jenkins LTS 2.568.2 and earlier
• Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6)

Discovery Timeline

• 2026-09-02 - CVE-2026-84647 published to NVD
• 2026-09-02 - Jenkins publishes Security Advisory 2026-09-02 (SECURITY-3915)
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84647

Vulnerability Analysis

Stapler is the request-dispatch and data-binding framework that maps HTTP form submissions to Java objects inside Jenkins. When a form is submitted, Stapler examines the request payload and reflectively constructs objects to populate fields on the target configuration class. The vulnerability stems from Stapler not enforcing that instantiated types are assignable to the declared field type. An attacker can therefore direct Stapler to instantiate classes that were never intended for a given binding target.

Exploitation requires only Overall/Read permission, which is granted broadly in most Jenkins deployments. Once an attacker can instantiate arbitrary Stapler-compatible configuration types, side effects triggered by constructors, setters, and @DataBoundConstructor logic can be abused to influence controller state. This design flaw affects a wide surface because form data binding is used across nearly every configuration endpoint in Jenkins.

Root Cause

The root cause is missing type-compatibility validation in Stapler's form data binding path. Stapler resolves a class name supplied by the request and constructs it without confirming that the resulting object is assignable to the expected field type. This is a classic unsafe deserialization pattern under [CWE-502], where trust in client-supplied type metadata leads to instantiation of unintended classes.

Attack Vector

An authenticated user with Overall/Read submits a crafted form request to a Jenkins endpoint that uses Stapler data binding. The request specifies a class name that Stapler will resolve and instantiate. Because the framework does not check assignability to the target field type, the attacker steers instantiation toward configuration classes whose construction logic yields further impact. No user interaction beyond the attacker's own request is required. Refer to the Jenkins Security Advisory 2026-09-02 for the technical write-up.

Detection Methods for CVE-2026-84647

Indicators of Compromise

• Unexpected POST requests to Jenkins configuration or form-submission endpoints from accounts with only Overall/Read permission.
• Form submissions containing stapler-class, $class, or kind parameters referencing classes unrelated to the target configuration screen.
• Jenkins controller logs showing instantiation of configuration types outside the expected class hierarchy for a given endpoint.

Detection Strategies

• Inspect Jenkins access logs for high volumes of POST traffic to /descriptorByName/, /configSubmit, and /submit endpoints originating from low-privilege users.
• Correlate authentication events with configuration-binding requests to identify read-only accounts submitting form data.
• Compare running Jenkins and Stapler versions against the fixed releases listed in the vendor advisory.

Monitoring Recommendations

• Forward Jenkins controller and access logs to a centralized log platform and alert on anomalous form parameters referencing arbitrary class names.
• Track new or unusual Descriptor instantiations in Jenkins logs following form submissions.
• Baseline normal configuration-change activity per user and alert on deviations, especially from service or read-only accounts.

How to Mitigate CVE-2026-84647

Immediate Actions Required

• Upgrade Jenkins to a version that ships Stapler 2088.2093.vd7c3e58008a_6 or a release newer than 2107.v8dfcb_e8ed317 with the fix applied.
• Audit Jenkins user permissions and remove Overall/Read from accounts that do not require it.
• Restrict network exposure of the Jenkins controller to trusted administrative networks.

Patch Information

Jenkins addresses CVE-2026-84647 in the releases identified in Jenkins Security Advisory 2026-09-02 (SECURITY-3915). The fix enforces that types instantiated through form data binding must be assignable to the declared field type. Administrators running Jenkins weekly 2.579 or earlier, or LTS 2.568.2 or earlier, should update to the patched weekly or LTS release referenced in the advisory.

Workarounds

• Enforce authentication and disable anonymous read access on the Jenkins controller.
• Apply the Authorization Strategy plugin to minimize the scope of Overall/Read across users and API tokens.
• Place the Jenkins controller behind a reverse proxy that restricts access to management endpoints by source IP.

# Example: restrict anonymous access via Jenkins CLI / Groovy init script
# Save as $JENKINS_HOME/init.groovy.d/restrict-read.groovy
import jenkins.model.Jenkins
import hudson.security.FullControlOnceLoggedInAuthorizationStrategy

def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
strategy.setAllowAnonymousRead(false)
Jenkins.instance.setAuthorizationStrategy(strategy)
Jenkins.instance.save()