CVE-2026-84670 Overview
CVE-2026-84670 is an insecure deserialization vulnerability in the Jenkins Performance Plugin version 1015.v09ca_52b_3370e and earlier. The plugin fails to restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller. Attackers with Item/Configure permission can leverage this weakness to execute arbitrary code on the Jenkins controller. The flaw is tracked under CWE-502: Deserialization of Untrusted Data and is documented in the Jenkins Security Advisory 2026-09-02.
Critical Impact
Authenticated attackers with Item/Configure permission can achieve arbitrary code execution on the Jenkins controller, compromising build integrity and potentially the entire CI/CD pipeline.
Affected Products
- Jenkins Performance Plugin 1015.v09ca_52b_3370e
- Jenkins Performance Plugin versions earlier than 1015.v09ca_52b_3370e
- Jenkins controllers with the Performance Plugin installed
Discovery Timeline
- 2026-09-02 - Jenkins publishes security advisory SECURITY-4026
- 2026-09-02 - CVE-2026-84670 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84670
Vulnerability Analysis
The Jenkins Performance Plugin caches performance reports as serialized objects in the build directory on the Jenkins controller. When the plugin loads these cached reports, it deserializes their contents without restricting the classes that can be instantiated. This unrestricted deserialization enables gadget-chain style attacks common to Java object serialization.
An attacker who possesses Item/Configure permission can influence the contents of the build directory. By placing a crafted serialized payload where the plugin expects a cached report, the attacker triggers instantiation of arbitrary classes during deserialization. This yields arbitrary code execution in the context of the Jenkins controller process.
Because the Jenkins controller typically holds credentials, agent secrets, and access to source code and deployment targets, code execution at this level can escalate into a full CI/CD compromise. The attack requires authentication, so the primary risk is from low-privileged insiders or attackers who have obtained project-level credentials.
Root Cause
The root cause is Insecure Deserialization [CWE-502]. The plugin uses Java deserialization on data read from the build directory without applying a class allowlist or safe deserialization filter. Any class present on the Jenkins controller classpath that provides a usable gadget chain becomes a potential execution primitive.
Attack Vector
Exploitation proceeds over the network against an authenticated Jenkins session. The attacker uses Item/Configure rights to arrange for a malicious serialized object to be read from a cached performance report path. When the plugin later deserializes that cached report, the crafted object graph executes attacker-controlled code on the controller. No user interaction beyond normal Jenkins job operation is required. Refer to the Jenkins Security Advisory 2026-09-02 for the vendor's technical description.
Detection Methods for CVE-2026-84670
Indicators of Compromise
- Unexpected files or modified serialized report artifacts within Jenkins build directories associated with the Performance Plugin.
- Jenkins controller processes spawning shells, curl, wget, or other unusual child processes during or after build execution.
- Outbound network connections from the Jenkins controller to unexpected hosts following plugin operations.
- Java stack traces referencing deserialization gadget classes in Jenkins logs.
Detection Strategies
- Audit Item/Configure permission assignments and correlate against recent job configuration changes.
- Monitor Jenkins audit logs for job configuration modifications that touch performance report paths.
- Inspect the Jenkins controller filesystem for serialized objects whose class signatures do not match expected Performance Plugin report classes.
Monitoring Recommendations
- Enable process and file integrity monitoring on the Jenkins controller host, including build workspace and cache directories.
- Alert on anomalous child processes of the Jenkins Java process and on outbound egress from the controller.
- Forward Jenkins system and audit logs to a centralized SIEM for retention and correlation.
How to Mitigate CVE-2026-84670
Immediate Actions Required
- Upgrade the Jenkins Performance Plugin to a version later than 1015.v09ca_52b_3370e as published in the Jenkins security advisory.
- Review and reduce accounts that hold Item/Configure permission, applying least privilege.
- Rotate credentials, tokens, and agent secrets stored on Jenkins controllers that may have been exposed.
- Inspect build directories for suspicious cached report files and remove untrusted artifacts.
Patch Information
Refer to the Jenkins Security Advisory 2026-09-02 (SECURITY-4026) for the fixed plugin version and remediation guidance. Apply the update through the Jenkins Plugin Manager and restart the controller to complete installation.
Workarounds
- If patching is not immediately possible, uninstall or disable the Performance Plugin until a fixed version can be applied.
- Restrict Item/Configure permission to trusted administrators only.
- Isolate the Jenkins controller from sensitive networks and enforce strict egress filtering until remediation is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
