CVE-2026-84650: Jenkins Use After Free Vulnerability

CVE-2026-84650 Overview

CVE-2026-84650 is an insecure deserialization vulnerability [CWE-502] affecting Jenkins 2.579 and earlier, and Jenkins LTS 2.568.2 and earlier. Jenkins fails to exclude transient fields from deserialization during configuration updates. Attackers with permission to submit configuration updates can specify values for transient fields that Jenkins deserializes. The runtime impact depends on how each affected transient field is used within the Jenkins core and installed plugins.

Critical Impact
Authenticated attackers can manipulate transient field values during deserialization, potentially leading to arbitrary object state injection with high impact to confidentiality, integrity, and availability.

Affected Products

Jenkins 2.579 and earlier
Jenkins LTS 2.568.2 and earlier
Jenkins plugins that rely on transient fields being non-persisted

Discovery Timeline

2026-09-02 - CVE-2026-84650 published to NVD via Jenkins Security Advisory #SECURITY-4032
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84650

Vulnerability Analysis

Jenkins uses XStream to serialize and deserialize configuration objects. The transient Java keyword marks fields that should be excluded from serialization. In vulnerable Jenkins releases, transient fields cannot be reliably excluded during deserialization of submitted configuration updates. This allows an authenticated attacker with configuration permissions to inject arbitrary values into fields that developers assumed were only populated at runtime.

Because many Jenkins components and plugins treat transient fields as trusted internal state, controlling their values through configuration submission bypasses assumed invariants. Consequences vary by plugin and field usage but can include privilege escalation, sensitive data disclosure, and integrity compromise across the Jenkins controller.

Root Cause

The root cause is improper enforcement of the transient modifier during XStream-backed deserialization in Jenkins configuration handling. Fields intended to be reconstructed at runtime remain writable through inbound configuration data.

Attack Vector

Exploitation requires network access to the Jenkins controller and authenticated permissions to submit configuration updates. An attacker crafts a configuration payload containing values for transient fields on the target object. When Jenkins processes the update, it deserializes the payload and populates those fields, altering runtime behavior. Refer to the Jenkins Security Advisory #SECURITY-4032 for affected components.

// No verified proof-of-concept code is available.
// See the Jenkins Security Advisory for technical details.

Detection Methods for CVE-2026-84650

Indicators of Compromise

Unexpected modifications to Jenkins job, credential, or global configuration XML files under $JENKINS_HOME/
Configuration submissions containing XML elements matching field names declared transient in Jenkins core or plugin classes
Anomalous authenticated POST requests to /configSubmit, /configure, or plugin configuration endpoints

Detection Strategies

Audit Jenkins access logs for configuration update requests from accounts that rarely modify configuration
Compare configuration XML in $JENKINS_HOME/ against known-good baselines to identify unexpected field entries
Enable Jenkins audit trail logging and forward events to a centralized SIEM for correlation

Monitoring Recommendations

Track version strings reported by the Jenkins controller to confirm patched builds are deployed
Alert on new or modified Jenkins user accounts granted Overall/Administer or Job/Configure permissions
Monitor Jenkins controller processes for unexpected child process execution following configuration changes

How to Mitigate CVE-2026-84650

Immediate Actions Required

Upgrade Jenkins weekly to 2.580 or later, and Jenkins LTS to 2.568.3 or later as directed by the vendor advisory
Restrict Overall/Administer and job configuration permissions to trusted accounts only
Review recent configuration changes in $JENKINS_HOME/ for signs of tampering

Patch Information

Jenkins has addressed CVE-2026-84650 in updated releases. Review the Jenkins Security Advisory #SECURITY-4032 for exact fixed version numbers and upgrade instructions. Apply patched releases before restoring broad configuration permissions.

Workarounds

Temporarily revoke configuration submission permissions from non-administrative users until patches are applied
Place the Jenkins controller behind an authenticated reverse proxy that restricts access to configuration endpoints
Enable role-based access control and enforce least privilege for all Jenkins user accounts

bash

# Verify installed Jenkins version against the fixed release
curl -s -u admin:$API_TOKEN https://jenkins.example.com/api/json | jq -r '.version'

# Restrict access to configuration endpoints at the reverse proxy layer
# Example nginx snippet
location ~ ^/(configSubmit|configure|manage) {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://jenkins_backend;
}