CVE-2026-84652 Overview
CVE-2026-84652 is a session fixation vulnerability in Jenkins, the widely deployed open-source automation server. Jenkins fails to rotate the session identifier when a user is authenticated through the remember me cookie. An attacker who can serve content on the same site as Jenkins can plant a known session cookie in the victim's browser. When the victim later authenticates via the remember me cookie, the attacker's pre-set session becomes authenticated as that user. The flaw affects Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier.
Critical Impact
Successful exploitation grants attackers full authenticated access to Jenkins as the victim, exposing build pipelines, credentials, and source code.
Affected Products
- Jenkins weekly releases 2.579 and earlier
- Jenkins LTS 2.568.2 and earlier
- Deployments sharing a site origin with attacker-controlled content
Discovery Timeline
- 2026-09-02 - Jenkins Security Advisory published (SECURITY-4016)
- 2026-09-02 - CVE-2026-84652 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84652
Vulnerability Analysis
The vulnerability is a session fixation flaw [CWE-384]. Session fixation occurs when an application accepts a session identifier chosen by an attacker and later associates it with an authenticated user. Jenkins performs session rotation during interactive login but omits this step when authentication occurs through the persistent remember me cookie. As a result, any session identifier present in the victim's browser before the automated re-authentication remains valid afterward.
Root Cause
The root cause is missing session identifier rotation in the code path that processes remember me cookie authentication. Secure authentication flows must invalidate any pre-authentication session and issue a fresh identifier once identity is established. Jenkins skips this step for remember me flows, leaving pre-existing session cookies bound to the newly authenticated user.
Attack Vector
Exploitation requires the attacker to control content served from the same site as the Jenkins instance, for example a sibling subdomain or a permissive reverse proxy path. The attacker sets a Jenkins session cookie in the victim's browser via that co-located content. When the victim's browser later triggers the remember me authentication flow to Jenkins, the pre-set cookie value is elevated to an authenticated session. The attacker, holding the same cookie value, gains authenticated access as the victim. See the Jenkins Security Advisory 2026-09-02 for technical details.
Detection Methods for CVE-2026-84652
Indicators of Compromise
- Multiple concurrent Jenkins sessions sharing the same JSESSIONID value from distinct source IP addresses.
- Session cookies observed on Jenkins that were first issued by an unrelated host on the same parent domain.
- Unexpected authenticated activity immediately following remember me cookie validation events in access logs.
Detection Strategies
- Correlate Jenkins access logs to identify session identifiers reused across geographically or network-distinct clients.
- Review reverse proxy and CDN logs for Set-Cookie headers targeting the Jenkins path from co-hosted applications.
- Audit Jenkins audit trails for privileged operations that follow automated remember me re-authentications.
Monitoring Recommendations
- Enable verbose authentication logging in Jenkins and forward logs to a centralized analytics platform.
- Alert on new job creations, credential accesses, and script console executions performed by accounts recently authenticated via remember me.
- Monitor for anomalous parent-domain cookie setting patterns from adjacent web properties.
How to Mitigate CVE-2026-84652
Immediate Actions Required
- Upgrade Jenkins to a version newer than 2.579, or LTS newer than 2.568.2, as soon as the fixed release is deployed.
- Invalidate all existing remember me cookies and force re-authentication for all users after patching.
- Restrict which hosts may serve content under the same site as Jenkins to reduce co-hosted attacker exposure.
Patch Information
Refer to the Jenkins Security Advisory 2026-09-02 for the fixed versions and upgrade guidance. The fix ensures the session identifier is rotated when a user is authenticated via the remember me cookie.
Workarounds
- Disable the remember me feature in Jenkins global security configuration until patching is complete.
- Host Jenkins on a dedicated origin that shares no parent domain with user-content or third-party applications.
- Set the Jenkins session cookie with the __Host- prefix and strict SameSite attributes at the reverse proxy where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
