CVE-2026-84669 Overview
CVE-2026-84669 is a path traversal vulnerability [CWE-22] in the Jenkins Allure Plugin version 2.35.2 and earlier. The flaw allows authenticated attackers with Item/Read permission on jobs that publish Allure report results to read arbitrary files from the Jenkins controller's file system. Exploitation requires only low-privilege access and no user interaction, and the vulnerability can be triggered remotely over the network.
Critical Impact
Attackers with basic job-read permissions can exfiltrate arbitrary files from the Jenkins controller, including credentials, secrets, build artifacts, and configuration data.
Affected Products
- Jenkins Allure Plugin version 2.35.2
- Jenkins Allure Plugin versions prior to 2.35.2
- Jenkins controllers that host jobs publishing Allure report results
Discovery Timeline
- 2026-09-02 - CVE-2026-84669 published to NVD alongside Jenkins Security Advisory #SECURITY-3645
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84669
Vulnerability Analysis
The Allure Plugin integrates Allure test reporting into Jenkins pipelines and publishes report results as build artifacts. The plugin exposes an endpoint that resolves file paths supplied by requesters when serving report content. Insufficient validation of user-supplied path components allows attackers to escape the intended report directory using traversal sequences such as ../.
An attacker with Item/Read permission on any job that publishes Allure results can craft a request that references files outside the report directory. The plugin then reads and returns the contents of the requested file from the Jenkins controller. This yields read access to files that the Jenkins controller process can access, which typically includes secrets/, credentials.xml, config.xml, SSH keys, and job workspaces.
The attack requires authentication, but Item/Read is one of the lowest permission tiers in Jenkins and is commonly granted to broad user groups in shared build environments.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin concatenates attacker-controlled input into a file path without canonicalizing the resulting path or verifying that it remains within the designated report directory.
Attack Vector
Exploitation is performed over the network against the Jenkins web interface. The attacker authenticates with any account holding Item/Read on a qualifying job, then issues an HTTP request to the vulnerable Allure report endpoint with a path parameter containing directory traversal sequences. The Jenkins Security Advisory does not publish request-level exploitation details. Refer to the Jenkins Security Advisory #SECURITY-3645 for authoritative technical information.
Detection Methods for CVE-2026-84669
Indicators of Compromise
- HTTP requests to Allure report endpoints containing ../, ..%2f, or URL-encoded traversal sequences in path parameters
- Access log entries showing successful reads of report URLs that resolve to files outside the expected build artifact directory
- Unexpected read access to sensitive files such as secrets/, credentials.xml, .ssh/, or config.xml by the Jenkins controller process
- Authenticated sessions from low-privilege accounts issuing repeated Allure report requests with abnormal path structures
Detection Strategies
- Monitor Jenkins access logs for path traversal patterns targeting Allure plugin URLs
- Correlate low-privilege user activity with reads of controller-side sensitive files
- Alert on Jenkins controller file access outside standard workspace and artifact directories
- Track anomalous request volume from Item/Read-only accounts to report endpoints
Monitoring Recommendations
- Forward Jenkins access, audit, and system logs to a centralized SIEM for retention and correlation
- Enable Jenkins audit trail plugins to record artifact and report access events
- Baseline normal Allure report request patterns and alert on deviations
How to Mitigate CVE-2026-84669
Immediate Actions Required
- Upgrade the Jenkins Allure Plugin to a version later than 2.35.2 once a fixed release is available from the plugin maintainers
- Audit Item/Read permission grants and remove access from accounts that do not require it
- Rotate credentials, API tokens, and SSH keys stored on the Jenkins controller if compromise is suspected
- Review Jenkins access logs for prior exploitation attempts targeting Allure report URLs
Patch Information
Refer to the Jenkins Security Advisory #SECURITY-3645 for the authoritative list of fixed versions and remediation guidance. Apply the vendor-supplied plugin update through the Jenkins Plugin Manager.
Workarounds
- Disable the Allure Plugin until the patched version can be installed if a fix is not yet available
- Restrict Item/Read permission on jobs that publish Allure results to trusted users only
- Isolate the Jenkins controller from sensitive file systems and store secrets in an external secrets manager rather than on the controller
# Configuration example: restrict plugin access via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
disable-plugin allure-jenkins-plugin -restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
