CVE-2026-84649: Jenkins Stapler CSRF Token Vulnerability

CVE-2026-84649 Overview

CVE-2026-84649 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Stapler web framework used by Jenkins. An HTTP endpoint serving dynamically generated JavaScript resources embeds the user's CSRF token (crumb) as a string literal in the response body. An attacker who controls a page hosted on the same site as Jenkins can retrieve this crumb and perform authenticated actions on behalf of the targeted user's session.

Critical Impact
Attackers with same-site page control can steal a valid CSRF crumb and execute arbitrary authenticated actions against Jenkins, undermining the crumb-based CSRF defense.

Affected Products

Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (inclusive), except 2088.2093.vd7c3e58008a_6
Jenkins 2.447 through 2.579 (inclusive)
Jenkins LTS 2.452.1 through 2.568.2 (inclusive)

Discovery Timeline

2026-09-02 - Jenkins publishes Security Advisory SECURITY-3878
2026-09-02 - CVE-2026-84649 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84649

Vulnerability Analysis

Jenkins relies on Stapler, its web framework, to route HTTP requests to Java objects and generate responses. To defend against CSRF attacks, Jenkins issues a per-session crumb that clients must include in state-changing requests.

The flaw resides in a Stapler HTTP endpoint that returns dynamically generated JavaScript. This endpoint embeds the requesting user's CSRF crumb directly into the response body as a JavaScript string literal. Because the resource is served as JavaScript, it can be loaded cross-origin via a <script> tag from any page an attacker controls on the same site as the Jenkins instance.

Once loaded, the attacker's script can read the crumb value and craft authenticated requests. This defeats the crumb-based CSRF protection Jenkins relies on to guard administrative and pipeline actions. Exploitation requires user interaction, such as visiting an attacker-controlled page, but no attacker privileges on Jenkins itself.

Root Cause

The root cause is unsafe inclusion of a session-scoped secret in a cacheable, script-loadable resource. The crumb should be scoped to same-origin fetches or delivered through channels that enforce origin restrictions. Embedding it as a JavaScript literal exposes it to any co-hosted page that can trigger a script load.

Attack Vector

An attacker hosts or controls a page on the same site as the Jenkins deployment, for example a subdomain or user-content path. The victim, authenticated to Jenkins, visits the malicious page. The page loads the vulnerable Stapler JavaScript endpoint, extracts the crumb, and issues cross-site authenticated requests. Impact includes job creation, configuration changes, and arbitrary script execution depending on the victim's Jenkins permissions.

See the Jenkins Security Advisory 2026-09-02 (SECURITY-3878) for vendor technical details.

Detection Methods for CVE-2026-84649

Indicators of Compromise

Unexpected cross-origin <script> requests to Stapler-served JavaScript endpoints in Jenkins access logs
POST requests to sensitive Jenkins endpoints originating from Referer headers outside the Jenkins application
Unexplained job configuration, plugin, or credential changes shortly after a user browses external pages

Detection Strategies

Review Jenkins access logs for requests to dynamically generated JavaScript endpoints followed by state-changing POSTs from the same session
Correlate Referer and Origin headers on crumb-protected endpoints to identify mismatches
Alert on administrative actions performed within short windows of external referrer activity

Monitoring Recommendations

Forward Jenkins reverse-proxy and application logs to a centralized analytics platform for correlation
Monitor for anomalous configuration or pipeline changes performed by privileged users
Track version metadata for Jenkins core, LTS, and the Stapler library across the estate

How to Mitigate CVE-2026-84649

Immediate Actions Required

Upgrade Jenkins weekly releases to a version newer than 2.579 that ships a fixed Stapler build
Upgrade Jenkins LTS to a release newer than 2.568.2 that includes the patched Stapler
Restrict Jenkins hosting so it does not share a site or parent domain with user-controllable content
Audit recent job, credential, and plugin changes for signs of unauthorized activity

Patch Information

Jenkins addresses the issue by updating the bundled Stapler library. Fixed Stapler versions are published beyond the affected range 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317. The intermediate release 2088.2093.vd7c3e58008a_6 is not affected. Consult the Jenkins Security Advisory 2026-09-02 for exact fixed versions and upgrade paths.

Workarounds

Isolate Jenkins on a dedicated hostname with no shared parent domain to prevent same-site page hosting by attackers
Enforce strict Content Security Policy at the reverse proxy to limit script loads from Jenkins endpoints
Reduce user permissions so that a stolen crumb yields limited administrative capability

bash

# Verify Jenkins core version before and after upgrade
curl -s -u admin:TOKEN https://jenkins.example.com/api/json | jq .
# Check installed Stapler version via the Jenkins about page or systemInfo
curl -s -u admin:TOKEN https://jenkins.example.com/systemInfo | grep -i stapler