CVE-2026-84665 Overview
CVE-2026-84665 is a stored cross-site scripting (XSS) vulnerability in the Jenkins SonarQube Scanner Plugin version 2.18.3 and earlier. The plugin builds dashboard links from SonarQube scanner results without restricting URL schemes. Attackers with Item/Configure permission can inject javascript: URLs that execute in the browser of any user who clicks the resulting dashboard link. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and disclosed in the Jenkins Security Advisory 2026-09-02.
Critical Impact
An authenticated attacker with Item/Configure permission can execute arbitrary JavaScript in the Jenkins UI, enabling session theft, privilege escalation, and pipeline tampering.
Affected Products
- Jenkins SonarQube Scanner Plugin 2.18.3
- Jenkins SonarQube Scanner Plugin versions prior to 2.18.3
- Jenkins controllers running the affected plugin
Discovery Timeline
- 2026-09-02 - Jenkins publishes Security Advisory SECURITY-3989
- 2026-09-02 - CVE-2026-84665 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84665
Vulnerability Analysis
The SonarQube Scanner Plugin renders dashboard links in the Jenkins UI based on data returned or supplied through scanner results. The plugin fails to constrain the URL scheme of these links to safe protocols such as http: and https:. As a result, an attacker who controls the configuration of a project can supply a javascript: URL that gets stored in the job configuration.
When another Jenkins user views the job page and clicks the dashboard link, the JavaScript payload executes in the context of the victim's authenticated session. Because the payload is stored server-side, exploitation persists across sessions and affects every user who interacts with the affected job.
The attack requires user interaction (UI:R) and prior authenticated access with Item/Configure permission, but it can escalate to full administrator compromise if a Jenkins administrator triggers the payload.
Root Cause
The root cause is missing URL scheme validation when rendering user-influenced links. The plugin treats scanner-supplied URLs as trusted and embeds them directly into anchor href attributes. Safe implementations enforce an allowlist of schemes, typically limited to http and https, before rendering links generated from external or user-controlled data.
Attack Vector
An attacker with Item/Configure permission configures a job that uses the SonarQube Scanner Plugin so that the dashboard URL uses the javascript: scheme with an arbitrary payload. The malicious URL is persisted in the job configuration. When any authenticated user, including administrators, opens the job page and follows the dashboard link, the browser evaluates the JavaScript in the Jenkins origin. See the Jenkins Security Advisory 2026-09-02 for advisory-level details.
Detection Methods for CVE-2026-84665
Indicators of Compromise
- Job configuration XML containing dashboard URL fields with javascript: scheme prefixes.
- Unexpected outbound requests from Jenkins user browsers to attacker-controlled domains following clicks on SonarQube dashboard links.
- New or modified Jenkins API tokens, credentials, or job configurations created shortly after an administrator viewed a SonarQube-integrated job.
Detection Strategies
- Audit config.xml files under $JENKINS_HOME/jobs/ for any URL field beginning with javascript:, data:, or vbscript:.
- Review Jenkins audit and access logs for Item/Configure actions performed by non-administrative accounts on jobs that integrate SonarQube.
- Inspect browser Content Security Policy (CSP) violation reports for inline script execution originating from the Jenkins origin.
Monitoring Recommendations
- Alert on modifications to Jenkins job configurations that introduce URLs with non-HTTP schemes.
- Monitor for anomalous session activity, such as token creation or job runs, immediately after users view SonarQube-linked pages.
- Track plugin inventory to detect Jenkins controllers still running SonarQube Scanner Plugin 2.18.3 or earlier.
How to Mitigate CVE-2026-84665
Immediate Actions Required
- Upgrade the Jenkins SonarQube Scanner Plugin to a version later than 2.18.3 as published in the Jenkins Security Advisory 2026-09-02.
- Restrict Item/Configure permission to trusted users through Jenkins role-based access control until patching is complete.
- Audit existing jobs for stored javascript: URLs and sanitize configurations before administrators view affected pages.
Patch Information
Refer to the Jenkins Security Advisory 2026-09-02 (SECURITY-3989) for the fixed plugin version and upgrade instructions. Apply the update through the Jenkins Plugin Manager or by deploying the patched .hpi artifact to $JENKINS_HOME/plugins/.
Workarounds
- Remove or disable the SonarQube Scanner Plugin on controllers where an upgrade cannot be applied immediately.
- Enforce a strict Content Security Policy in Jenkins to block inline script execution triggered by javascript: URLs.
- Reduce the number of accounts holding Item/Configure permission and require review of job configuration changes.
# Identify jobs containing javascript: URLs in stored configuration
grep -RIl --include=config.xml 'javascript:' "$JENKINS_HOME/jobs/"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
