CVE-2026-84677: Jenkins Update-Center2 XSS Vulnerability

CVE-2026-84677 Overview

CVE-2026-84677 is a stored cross-site scripting (XSS) vulnerability in Jenkins update-center2 version 3.18.3 and earlier. The application fails to escape plugin-provided values on plugin download index pages. Affected fields include plugin names, descriptions, and version metadata. Attackers who can submit a plugin for hosting can inject persistent JavaScript payloads. The payloads execute in the browsers of users viewing the plugin download pages. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers with plugin submission access can execute arbitrary JavaScript in the context of the Jenkins update center, targeting administrators and downstream Jenkins instances that consume the index.

Affected Products

Jenkins update-center2 version 3.18.3
Jenkins update-center2 versions prior to 3.18.3
Jenkins plugin distribution infrastructure relying on update-center2

Discovery Timeline

2026-09-02 - CVE-2026-84677 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-4038 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84677

Vulnerability Analysis

Jenkins update-center2 generates HTML index pages that list plugins available for download. The generator ingests plugin metadata supplied by plugin authors and renders that metadata directly into HTML output. The affected fields include plugin names, descriptions, and version metadata. Because these values are not HTML-escaped before rendering, an attacker who submits a plugin can embed HTML or JavaScript in any of these fields.

The injected script is stored server-side within the update center content and served to every visitor of the plugin download index page. This produces a stored XSS condition rather than a reflected one, which increases exposure across the Jenkins plugin ecosystem.

Root Cause

The root cause is missing output encoding in the update-center2 template rendering path. Plugin-provided string fields are treated as trusted content and inserted into HTML without contextual escaping. The vulnerability is a canonical instance of CWE-79, where user-controllable input flows unfiltered into a browser-executed context.

Attack Vector

An attacker must be able to provide a plugin for hosting through the Jenkins plugin distribution process. The attacker crafts plugin metadata containing HTML or JavaScript payloads in the name, description, or version fields. Once update-center2 processes and publishes the plugin index, the payload executes in the browser of anyone visiting the affected download page. The scope change reflected in the CVSS vector indicates the payload can reach users outside the vulnerable component's original security boundary.

No verified exploit code is publicly available. Refer to the Jenkins Security Advisory 2026-09-02 for authoritative technical details.

Detection Methods for CVE-2026-84677

Indicators of Compromise

Plugin metadata fields (name, description, version) containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=.
Unexpected outbound requests from browsers rendering the plugin download index page to attacker-controlled domains.
Newly submitted plugins whose metadata includes URL-encoded or Unicode-escaped payloads designed to bypass naive filters.

Detection Strategies

Perform static scanning of the update-center.json output and generated HTML index pages for HTML control characters within plugin metadata fields.
Inspect plugin submission pipelines for metadata that fails a strict allowlist of alphanumeric characters, punctuation, and expected version formats.
Deploy Content Security Policy (CSP) reporting to capture inline script violations on update center pages.

Monitoring Recommendations

Log and review plugin submission events, including author identity and full metadata payloads, for offline analysis.
Alert on modifications to hosted plugin metadata after initial publication.
Monitor administrator browser sessions accessing plugin download pages for anomalous DOM activity or session token exfiltration attempts.

How to Mitigate CVE-2026-84677

Immediate Actions Required

Upgrade Jenkins update-center2 to a release later than 3.18.3 that includes the fix referenced in SECURITY-4038.
Audit currently hosted plugin metadata for HTML or JavaScript content and remove or re-encode any affected entries.
Restrict plugin submission privileges to trusted maintainers until the patched version is deployed.

Patch Information

Jenkins has published fix details in the Jenkins Security Advisory 2026-09-02 under advisory identifier SECURITY-4038. Operators of self-hosted update centers based on update-center2 should update to the fixed release and regenerate all published index pages so previously stored payloads are re-rendered with proper escaping.

Workarounds

Enforce a strict Content Security Policy on update center pages that disallows inline scripts and restricts script sources to trusted origins.
Validate plugin metadata at submission time using an allowlist that rejects HTML control characters in name, description, and version fields.
Serve plugin download index pages through a reverse proxy that applies HTML sanitization on plugin-provided fields until the patch is applied.

bash

# Configuration example: strict CSP header for update center pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";