CVE-2026-84656: Jenkins Information Disclosure Vulnerability

CVE-2026-84656 Overview

CVE-2026-84656 is a missing authorization vulnerability in Jenkins that allows authenticated attackers to read build parameter names and values from jobs they lack access to. The flaw affects Jenkins 2.579 and earlier, as well as LTS 2.568.2 and earlier. Attackers only need Item/Read permission on at least one job to exploit the issue. The vulnerability is categorized under [CWE-862] Missing Authorization and can lead to disclosure of sensitive build parameters such as credentials, tokens, or environment configuration values embedded in job runs.

Critical Impact
Authenticated users with minimal permissions can enumerate build parameter names and values from restricted Jenkins jobs, potentially exposing secrets passed as parameters.

Affected Products

Jenkins weekly releases 2.579 and earlier
Jenkins LTS 2.568.2 and earlier
Jenkins controllers with multi-tenant job configurations

Discovery Timeline

2026-09-02 - Jenkins Security Advisory published (SECURITY-4006)
2026-09-02 - CVE CVE-2026-84656 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84656

Vulnerability Analysis

The vulnerability stems from a missing permission check in Jenkins core when handling requests for build parameter metadata. Jenkins enforces per-item authorization via the Item/Read permission, which controls whether a user can view a job and its associated data. In vulnerable versions, an authorization gap allowed users holding Item/Read on any single job to retrieve build parameter names and values from other jobs on the same controller. This breaks the tenant isolation model many organizations rely on when hosting shared Jenkins infrastructure across teams.

Build parameters often carry sensitive data. Teams routinely pass API keys, deployment tokens, environment identifiers, and internal hostnames as parameters at build time. Exposing these values to unauthorized users effectively downgrades any secret protection that depended on job-level access control.

Root Cause

The root cause is an incomplete access control decision in the code path that returns parameter data. The endpoint verifies that the requesting user is authenticated and possesses Item/Read on some job, but does not re-check the permission against the target job whose parameters are being returned. This is a classic instance of [CWE-862] Missing Authorization where a shared code path fails to scope the authorization check to the specific resource being accessed.

Attack Vector

An attacker authenticates to Jenkins using any account with Item/Read on at least one job. The attacker then issues requests to the affected endpoint referencing job names they wish to enumerate. Job names can be discovered through other low-privilege endpoints or guessed through common naming conventions. The server returns build parameter names and their recorded values without validating access to the target job. No user interaction is required, and the attack is executed over the network against the Jenkins HTTP interface. Refer to the Jenkins Security Advisory 2026-09-02 for endpoint-level technical detail.

Detection Methods for CVE-2026-84656

Indicators of Compromise

Repeated authenticated HTTP requests from a single user account referencing job names outside that user's normal scope.
Access log entries showing enumeration patterns against build parameter endpoints across many job/ paths.
Requests from low-privilege service accounts to jobs owned by unrelated teams or projects.

Detection Strategies

Review Jenkins access logs for users querying job data across multiple folders or team boundaries within short time windows.
Correlate authentication events with API request volume to identify accounts exhibiting reconnaissance behavior.
Baseline normal per-user job access patterns and alert on deviations, particularly for accounts with minimal assigned permissions.

Monitoring Recommendations

Forward Jenkins controller access logs and audit logs to a centralized logging platform for retention and query.
Enable the Jenkins Audit Trail plugin to capture detailed API access events including requesting user identity.
Alert on any authenticated user issuing requests to more distinct job/ paths than defined by role assignments.

How to Mitigate CVE-2026-84656

Immediate Actions Required

Upgrade Jenkins weekly to version 2.580 or later, or Jenkins LTS to 2.568.3 or later.
Rotate any credentials, tokens, or secrets that may have been passed as build parameters on affected controllers.
Audit user and group permissions to reduce the number of accounts holding Item/Read on any job.

Patch Information

Jenkins addressed the issue in weekly release 2.580 and LTS 2.568.3. The fix adds the missing per-job authorization check to the parameter retrieval code path. See the Jenkins Security Advisory 2026-09-02 for full patch metadata and version details.

Workarounds

Remove Item/Read grants from users who do not require job visibility, reducing the population of accounts capable of exploiting the flaw.
Store sensitive values in the Jenkins Credentials store and reference them via credential bindings rather than passing them as plain build parameters.
Restrict network access to the Jenkins controller so that only trusted user populations can reach the HTTP interface.

bash

# Verify installed Jenkins version on the controller host
java -jar jenkins.war --version

# Example: check LTS version against the fixed release
# Vulnerable: 2.568.2 or earlier
# Fixed:      2.568.3 or later