CVE-2026-84654: Jenkins Privilege Escalation Vulnerability

CVE-2026-84654 Overview

CVE-2026-84654 is a vulnerability in the Stapler web framework used by Jenkins. In Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6), form data binding allows attackers to set public static fields on the bound configuration object. Because static fields are shared across the Java Virtual Machine, an authenticated attacker who can submit configuration forms can modify state that applies globally to the Jenkins instance. The flaw is tracked as CWE-472: External Control of Assumed-Immutable Web Parameter and is included in Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier.

Critical Impact
An authenticated attacker submitting a configuration form can alter public static fields on Jenkins configuration objects, causing changes that persist globally across the Jenkins instance.

Affected Products

Jenkins Stapler 2107.v8dfcb_e8ed317 and earlier
Jenkins weekly 2.579 and earlier
Jenkins LTS 2.568.2 and earlier

Discovery Timeline

2026-09-02 - Jenkins Security Advisory published for SECURITY-3926
2026-09-02 - CVE-2026-84654 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84654

Vulnerability Analysis

Stapler is the web framework Jenkins uses to bind HTTP request parameters onto Java objects that back configuration screens. When a user submits a configuration form, Stapler reflectively maps submitted field names to matching fields on the bound object. The affected versions do not exclude public static fields from this binding process.

Static fields belong to the class itself rather than to an instance. When Stapler writes to a public static field during request handling, the value is shared across every user, session, and job that references that class. An attacker who is permitted to submit any configuration form whose bound class exposes a public static field can therefore mutate global Jenkins state.

Root Cause

The root cause is missing type discrimination in Stapler's parameter binding logic. The framework treats static fields as valid binding targets when it should restrict writes to instance fields. This matches [CWE-472], where a parameter assumed to be immutable by server logic is in fact externally controllable through the request.

Attack Vector

Exploitation requires network access to the Jenkins UI and an authenticated account with permission to submit at least one configuration form. The attacker crafts a form POST that includes a parameter name matching a public static field on the bound configuration object. Stapler assigns the attacker-supplied value to that static field, and the change becomes visible to every subsequent request handled by the JVM. No user interaction is required beyond the attacker's own submission.

No public proof-of-concept or in-the-wild exploitation has been reported. The concrete impact depends on which plugin or core class exposes a public static field whose value influences security-sensitive behavior.

Detection Methods for CVE-2026-84654

Indicators of Compromise

Unexpected configuration form POST requests containing parameter names that correspond to public static fields on Jenkins core or plugin classes.
Global Jenkins settings, feature flags, or plugin defaults that change without a corresponding administrator action in the audit log.
Job or build behavior that shifts uniformly across the instance immediately after a low-privilege user submits a configuration form.

Detection Strategies

Enable Jenkins audit logging and correlate doConfigSubmit and related form submission endpoints with the submitting user and the raw parameter names.
Inspect Jenkins access logs for POST requests to /configure, /configureSecurity, /manage, and plugin configuration URLs originating from accounts that do not normally administer the instance.
Compare current Jenkins system configuration and plugin configuration against a known-good baseline to identify unauthorized drift.

Monitoring Recommendations

Forward Jenkins controller logs and reverse proxy access logs to a centralized SIEM for retention and correlation.
Alert on configuration form submissions performed by non-administrator accounts.
Track the installed versions of Jenkins core, LTS, and the Stapler library to confirm patched releases are in use.

How to Mitigate CVE-2026-84654

Immediate Actions Required

Upgrade Jenkins weekly to a release later than 2.579 or Jenkins LTS to a release later than 2.568.2 that ships a fixed Stapler version.
Upgrade the Stapler library to a version later than 2107.v8dfcb_e8ed317, or use the fixed backport 2088.2093.vd7c3e58008a_6.
Review Jenkins permission assignments and remove configuration privileges from accounts that do not require them.

Patch Information

Jenkins published the fix in Security Advisory 2026-09-02 under identifier SECURITY-3926. Refer to the Jenkins Security Advisory 2026-09-02 for the specific Jenkins core, LTS, and Stapler versions that contain the fix. The patched Stapler releases exclude public static fields from form data binding.

Workarounds

Restrict Overall/Administer, Overall/Manage, and per-item Configure permissions to trusted users until the upgrade is applied.
Place the Jenkins controller behind an authenticating reverse proxy and limit access to the configuration endpoints to administrator source ranges.
Audit installed plugins and remove any that are unmaintained or expose configuration forms to low-privilege roles.

bash

# Verify installed Jenkins and Stapler versions
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/manage/systemInfo" | \
  grep -Ei 'jenkins.version|stapler'