CVE-2026-84648: Jenkins System Log Viewer XSS Vulnerability

CVE-2026-84648 Overview

CVE-2026-84648 is a stored cross-site scripting (XSS) vulnerability in the Jenkins system log viewer. Jenkins versions 2.579 and earlier, and LTS 2.568.2 and earlier fail to escape log record metadata, specifically the source, level, and timestamp fields. Attackers who control an agent process can inject malicious script content into log records. When a Jenkins administrator views the system log, the injected payload executes in the browser context. This weakness maps to [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers controlling a Jenkins agent can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover and controller compromise.

Affected Products

Jenkins weekly 2.579 and earlier
Jenkins LTS 2.568.2 and earlier
Jenkins controllers exposing the system log viewer to authenticated administrators

Discovery Timeline

2026-09-02 - CVE-2026-84648 published to NVD
2026-09-02 - Jenkins Security Advisory 2026-09-02 released (SECURITY-3967)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84648

Vulnerability Analysis

The Jenkins system log viewer renders log records emitted by controllers and connected agents. The viewer displays record metadata alongside the log message itself. The affected versions do not HTML-encode the source, level, and timestamp metadata fields before rendering them. An attacker who controls an agent process can craft log records whose metadata contains HTML or JavaScript. The Jenkins controller stores these records and serves them back to any administrator who opens the system log viewer. The payload executes with the privileges of the viewing user, typically an administrator with full Jenkins control.

Root Cause

The root cause is missing output encoding in the log viewer's rendering path. Jenkins treats agent-supplied log metadata as trusted display data rather than untrusted input. Because agents can emit arbitrary strings into these fields, the trust boundary between agent and controller is violated at the point of rendering.

Attack Vector

Exploitation requires the attacker to control a connected Jenkins agent process or the code running on that agent. The attacker emits log records containing script payloads embedded in the source, level, or timestamp fields. The stored payload triggers when an authenticated administrator opens the affected view. User interaction is required, which aligns with the network attack vector and user interaction requirement described in the advisory. Successful exploitation grants script execution in the administrator's session, enabling CSRF against Jenkins APIs, credential theft, and pipeline manipulation.

See the Jenkins Security Advisory 2026-09-02 for technical details.

Detection Methods for CVE-2026-84648

Indicators of Compromise

Log records in Jenkins system logs containing HTML tags, <script> fragments, or JavaScript event handlers within source, level, or timestamp fields
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after viewing the system log
New Jenkins user accounts, API tokens, or credential store entries created immediately after administrator log-viewer access

Detection Strategies

Inspect Jenkins log record stores and JCasC exports for metadata fields containing angle brackets, quotes, or script keywords
Correlate agent activity with anomalous log record content to identify agents emitting malformed metadata
Alert on Jenkins configuration changes, credential exports, or job modifications that occur within the same session as a system log view

Monitoring Recommendations

Enable web access logging on the Jenkins controller and monitor requests to /log/ endpoints and subsequent authenticated API calls
Ingest Jenkins controller and agent logs into a centralized SIEM for retention and cross-correlation
Track administrator session activity for privilege changes, plugin installs, or Groovy script executions following log viewer access

How to Mitigate CVE-2026-84648

Immediate Actions Required

Upgrade Jenkins weekly to 2.580 or later, and Jenkins LTS to 2.568.3 or later per the vendor advisory
Restrict agent connections to trusted operators only and audit currently connected agents
Rotate Jenkins administrator credentials and API tokens if administrators viewed the system log while untrusted agents were connected

Patch Information

Jenkins addressed the issue by properly escaping log record metadata in the system log viewer. Apply the fixed versions referenced in the Jenkins Security Advisory 2026-09-02. No configuration change is required after upgrade.

Workarounds

Avoid viewing the system log page on unpatched controllers while untrusted agents are connected
Disconnect or block agents whose operators are not fully trusted until the upgrade is applied
Enforce Content Security Policy headers on the Jenkins controller to reduce the impact of injected script execution

bash

# Example: verify Jenkins version after upgrade
curl -s -u admin:$JENKINS_TOKEN https://jenkins.example.com/api/json | jq '.'
# Check installed version header
curl -sI https://jenkins.example.com/ | grep -i '^X-Jenkins:'