CVE-2026-84645
Last modified
CVE-2026-84645 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted `config.xml` documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Jenkins | < 2.568.3 |
| Jenkins | Jenkins | < 2.580 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-84645?
How severe is CVE-2026-84645?
How do I fix CVE-2026-84645?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84637Malicious calendar invitations could use file URI attachment…9.8
- CVE-2026-84639Triggering an error condition in certain MIME bodies would c…9.1
- CVE-2026-8464Golem OEE MES is vulnerable to an unauthenticated path trave…8.3
- CVE-2026-84640A maliciously constructed mail header could lead to a one by…7.5
- CVE-2026-84641A malicious IMAP server can trigger use-after-free and heap-…7.5
- CVE-2026-84642The values of the mail.allowed_attachment_hostnames advanced…7.5
- CVE-2026-84646In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user …4.3
- CVE-2026-84647In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093…8.8
- CVE-2026-84648In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the s…8.8
- CVE-2026-84649In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317…8.8
- CVE-2026-84650In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, trans…8.8
- CVE-2026-84651In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the R…6.3
Are you affected by CVE-2026-84645?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST