CVE-2026-84658 Overview
CVE-2026-84658 is an information disclosure vulnerability in the Jenkins Script Security Plugin. Versions 1412.v7737b_3405f86 and earlier apply the @DataBoundConstructor annotation to a constructor that loads script approval configuration. Attackers with permission to submit certain forms can abuse this behavior to read the script approval configuration. The flaw is tracked as an Information Exposure issue [CWE-200] and requires low-privileged authenticated access to a Jenkins controller running the affected plugin.
Critical Impact
Authenticated attackers with form submission access can read script approval configuration data managed by the Script Security Plugin, exposing sensitive automation policy information.
Affected Products
- Jenkins Script Security Plugin version 1412.v7737b_3405f86
- All prior versions of the Jenkins Script Security Plugin
- Jenkins controllers relying on the plugin for sandboxed Groovy script approval
Discovery Timeline
- 2026-09-02 - Jenkins Security Advisory published as SECURITY-3986
- 2026-09-02 - CVE-2026-84658 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84658
Vulnerability Analysis
The Script Security Plugin manages approvals for Groovy scripts executed within Jenkins pipelines and job definitions. It maintains configuration describing which script hashes and signatures have been approved for execution. This configuration is intended to be readable only by administrators.
The plugin exposes a constructor annotated with @DataBoundConstructor, which Jenkins uses to instantiate objects from submitted form data. Because the annotated constructor loads script approval configuration during instantiation, any user permitted to submit the relevant form triggers a code path that returns configuration state through the form binding response. The result is unauthorized read access to sensitive plugin data by low-privileged users.
Root Cause
The root cause is misuse of the @DataBoundConstructor annotation on a constructor that performs privileged data loading. Jenkins invokes data-bound constructors during form submission handling without applying the access controls that guard the underlying configuration. The plugin does not perform an explicit permission check inside the constructor before reading script approval state.
Attack Vector
Exploitation requires network access to the Jenkins web interface and an authenticated account with permission to submit the affected forms. The attacker submits a crafted form request that causes Jenkins to invoke the vulnerable data-bound constructor. The constructor loads script approval configuration and returns it through the standard form processing response, disclosing configuration content the user should not access. No user interaction beyond the attacker's own request is required.
See the Jenkins Security Advisory 2026-09-02 for technical details.
Detection Methods for CVE-2026-84658
Indicators of Compromise
- Unexpected POST requests from low-privileged users to Script Security Plugin form endpoints on the Jenkins controller.
- Access log entries showing non-administrative accounts submitting forms that reference script approval configuration classes.
- Anomalous read patterns targeting the plugin during periods without legitimate administrative activity.
Detection Strategies
- Review Jenkins audit logs for form submissions to Script Security Plugin descriptors by accounts lacking Overall/Administer permission.
- Correlate authenticated web requests against Jenkins RBAC assignments to identify privilege boundary crossings.
- Baseline normal administrator activity against the plugin and alert on deviations by standard developer or job-configuration accounts.
Monitoring Recommendations
- Enable the Jenkins Audit Trail Plugin and forward events to a centralized SIEM for retention and correlation.
- Monitor plugin inventory for the installed version of Script Security and alert when 1412.v7737b_3405f86 or earlier is present.
- Track outbound access patterns from Jenkins controllers to detect follow-on abuse of any disclosed configuration.
How to Mitigate CVE-2026-84658
Immediate Actions Required
- Upgrade the Jenkins Script Security Plugin to the fixed release published in the Jenkins Security Advisory 2026-09-02.
- Audit user permissions and remove form submission or job configuration rights from accounts that do not require them.
- Review recent Jenkins access logs for unauthorized form submissions targeting the plugin.
Patch Information
Jenkins published fix guidance in the Jenkins Security Advisory 2026-09-02 under identifier SECURITY-3986. Administrators should upgrade the Script Security Plugin to the version listed as fixed in that advisory. Restart the Jenkins controller if required by the plugin manager to load the patched code.
Workarounds
- Restrict Jenkins accounts to the minimum permissions required, particularly removing configuration and form submission rights from untrusted users.
- Place the Jenkins controller behind an authenticating reverse proxy that limits which internal users can reach configuration endpoints.
- Monitor and alert on form submissions to Script Security Plugin endpoints until the patch is applied.
Refer to the Jenkins Security Advisory 2026-09-02 for authoritative patch versions and configuration guidance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
