CVE-2026-84664: Jenkins GitLab Plugin Auth Bypass Flaw

CVE-2026-84664 Overview

CVE-2026-84664 affects the Jenkins GitLab Plugin version 1.9.16 and earlier. The plugin permits overwriting the global GitLab connection configuration through Stapler data binding. Attackers with limited Jenkins access can redirect the plugin to an attacker-controlled URL. GitLab API tokens configured by administrators are then transmitted to the attacker-specified endpoint.

The vulnerability is categorized under [CWE-471] (Modification of Assumed-Immutable Data). It carries a network attack vector and requires low privileges without user interaction.

Critical Impact
Attackers with authenticated Jenkins access can capture administrator-configured GitLab API tokens by redirecting connections to attacker-controlled infrastructure.

Affected Products

Jenkins GitLab Plugin 1.9.16
Jenkins GitLab Plugin versions prior to 1.9.16
Jenkins controllers with the GitLab Plugin installed

Discovery Timeline

2026-09-02 - CVE-2026-84664 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-4097 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84664

Vulnerability Analysis

The Jenkins GitLab Plugin exposes configuration properties through Stapler, the web framework Jenkins uses to bind HTTP request parameters to Java object fields. The plugin fails to restrict which fields can be modified through data binding. Authenticated users can submit crafted requests that overwrite the global GitLab connection URL.

Once the connection URL is changed, subsequent GitLab API calls use the attacker-supplied endpoint. The plugin continues to authenticate using GitLab API tokens that administrators previously configured. The tokens are transmitted to the attacker-controlled server during normal plugin operations.

The vulnerability enables credential theft without requiring administrator privileges on the Jenkins controller. Captured GitLab tokens can be replayed against the legitimate GitLab instance to access repositories, modify code, or pivot into downstream CI/CD systems.

Root Cause

The root cause is improper protection of assumed-immutable configuration data ([CWE-471]). The plugin treats the global GitLab connection URL as trusted after initial administrator configuration. Stapler data binding does not enforce field-level authorization on subsequent write requests. Any authenticated request able to reach the plugin's binding surface can mutate this configuration.

Attack Vector

An authenticated attacker with low Jenkins privileges sends a crafted HTTP request to a plugin endpoint bound through Stapler. The request includes parameters that overwrite the global GitLab server URL with an attacker-controlled host. When Jenkins next issues a GitLab API request, the plugin transmits the stored administrator token to the attacker. See the Jenkins Security Advisory SECURITY-4097 for advisory details.

Detection Methods for CVE-2026-84664

Indicators of Compromise

Outbound HTTPS connections from the Jenkins controller to unexpected hosts resembling GitLab endpoints
Changes to global GitLab connection URLs in Jenkins configuration history that do not correspond to administrator activity
GitLab audit log entries showing API token usage from unexpected source IP addresses
Unauthorized modifications to org.jenkinsci.plugins.gitlab configuration files on the controller

Detection Strategies

Compare running Jenkins GitLab Plugin configuration against a known-good baseline stored in configuration-as-code
Monitor Jenkins audit and configuration history logs for changes to global GitLab connections initiated by non-administrator users
Correlate Jenkins outbound network traffic against an allow-list of approved GitLab instances
Review GitLab personal access token telemetry for use from IPs outside expected Jenkins controller ranges

Monitoring Recommendations

Enable Jenkins Audit Trail Plugin and forward logs to a central SIEM for review
Alert on any HTTP POST to Jenkins configuration endpoints from accounts lacking administrator role
Track GitLab API token last-used timestamps and source IPs through GitLab's admin audit log
Baseline expected outbound connection destinations from Jenkins controllers and alert on deviations

How to Mitigate CVE-2026-84664

Immediate Actions Required

Upgrade the Jenkins GitLab Plugin to a version later than 1.9.16 once available from the Jenkins update center
Rotate all GitLab API tokens and personal access tokens configured in Jenkins GitLab connections
Audit Jenkins configuration history for unauthorized changes to global GitLab connection URLs
Review GitLab audit logs for suspicious API activity originating from unexpected source addresses

Patch Information

Refer to the Jenkins Security Advisory SECURITY-4097 for the fixed version and upgrade instructions. Apply the patched plugin through the Jenkins Plugin Manager and restart the controller.

Workarounds

Restrict Jenkins access so that only trusted, authenticated users can reach the controller
Apply the principle of least privilege by removing unnecessary Overall/Read and job-level permissions from standard users
Use short-lived, scoped GitLab access tokens rather than long-lived personal access tokens
Place the Jenkins controller behind egress filtering that restricts outbound HTTPS to approved GitLab hosts only

bash

# Configuration example: restrict Jenkins outbound egress to approved GitLab hosts
# Example iptables rule allowing only gitlab.example.com (replace IP with your GitLab host)
iptables -A OUTPUT -p tcp -d gitlab.example.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT