CVE-2026-84655: Jenkins REST API XSS Vulnerability

CVE-2026-84655 Overview

CVE-2026-84655 affects Jenkins, the widely used open-source automation server. Jenkins 2.579 and earlier, along with LTS 2.568.2 and earlier, fail to escape map keys when serializing objects as JSON and Python through the REST API. Attackers who control map property names can inject arbitrary fields into JSON and Python API responses. The flaw is classified under [CWE-116] (Improper Encoding or Escaping of Output). Exploitation requires low-privileged authenticated access over the network and can compromise the integrity of API consumers relying on Jenkins response data.

Critical Impact
Authenticated attackers can inject arbitrary fields into Jenkins JSON and Python REST API responses, potentially misleading downstream automation, dashboards, and integrations that trust API output.

Affected Products

Jenkins 2.579 and earlier (weekly release line)
Jenkins LTS 2.568.2 and earlier
Jenkins REST API endpoints returning JSON or Python-serialized data

Discovery Timeline

2026-09-02 - CVE-2026-84655 published to the National Vulnerability Database (NVD)
2026-09-02 - Jenkins publishes Security Advisory SECURITY-3879
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84655

Vulnerability Analysis

Jenkins exposes a REST API that can serialize server-side Java objects into JSON and Python-formatted responses. During serialization, map data structures are rendered as key-value pairs. Jenkins escapes map values correctly but does not apply the same escaping treatment to map keys.

When an attacker can influence the property names within a map that Jenkins serializes, the resulting output can be manipulated to embed attacker-chosen JSON or Python syntax. This effectively lets the attacker inject additional structured fields into the API response body. The vulnerability is a serialization output-encoding failure rather than a parser bug in Jenkins itself.

The practical impact depends on how downstream consumers process the responses. Automated pipelines, CI/CD dashboards, and third-party integrations that parse Jenkins REST output may act on injected fields, leading to incorrect trust decisions or logic bypass in dependent systems.

Root Cause

The root cause is improper output encoding in the JSON and Python serializers used by the Jenkins REST API. Map keys were treated as trusted string data and emitted directly into the response stream without escaping reserved characters. Any code path that permits user-controlled data to become a map property name in a serialized object exposes the flaw.

Attack Vector

Exploitation is remote and requires low-privileged authenticated access to Jenkins. An attacker must identify a REST endpoint that serializes a map whose keys are derived from user-controllable input. By crafting key names containing structural delimiters, the attacker injects arbitrary fields into the JSON or Python response consumed by clients. No specific exploit code is required beyond ordinary REST API requests targeting the affected endpoints. Refer to the Jenkins Security Advisory for SECURITY-3879 for endpoint-specific technical details.

Detection Methods for CVE-2026-84655

Indicators of Compromise

REST API responses from /api/json or /api/python containing unexpected structural characters within field names.
Audit log entries showing authenticated API calls that create or update objects with unusual property names containing quotes, colons, or braces.
Downstream automation errors caused by malformed or unexpected fields returned from Jenkins.

Detection Strategies

Inspect Jenkins access logs for authenticated requests to REST API paths ending in /api/json or /api/python combined with prior write operations from the same user.
Compare serialized API response schemas against expected baselines to flag injected or duplicate keys.
Correlate low-privilege user activity that creates named entities (jobs, parameters, credentials descriptions) containing delimiter characters.

Monitoring Recommendations

Forward Jenkins controller logs and audit events to a centralized log platform for schema-aware analysis.
Alert on any user-controlled string containing ", :, {, or } submitted to endpoints that later appear in map-keyed API output.
Monitor CI/CD integrations that consume Jenkins REST API data for parsing exceptions or unexpected field handling.

How to Mitigate CVE-2026-84655

Immediate Actions Required

Upgrade Jenkins to a version newer than 2.579 or Jenkins LTS to a version newer than 2.568.2 as directed in the Jenkins Security Advisory for SECURITY-3879.
Review and restrict Overall/Read and object creation permissions for untrusted users on the Jenkins controller.
Audit downstream systems that consume Jenkins JSON or Python API responses to confirm they validate response schemas.

Patch Information

Jenkins has published fixes in the SECURITY-3879 advisory. Administrators should apply the Jenkins weekly release later than 2.579 or the LTS release later than 2.568.2. Consult the Jenkins Security Advisory for SECURITY-3879 for the exact fixed version numbers applicable to your release channel.

Workarounds

Limit access to the Jenkins REST API to trusted users and service accounts using authentication and authorization controls.
Restrict permissions that allow creation of named entities whose identifiers could become map keys in serialized responses.
Add schema validation in API consumers to reject responses containing unexpected or duplicate fields until the patch is applied.

bash

# Example: restrict anonymous access and enforce Matrix Authorization
# in Jenkins configuration as an interim hardening step
curl -u admin:$JENKINS_TOKEN \
  -X POST "$JENKINS_URL/manage/configureSecurity/configure" \
  --data-urlencode "json={\"useSecurity\":true,\"authorizationStrategy\":\"hudson.security.GlobalMatrixAuthorizationStrategy\"}"