CVE-2026-84649
Last modified
CVE-2026-84649 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-84649?
How severe is CVE-2026-84649?
How do I fix CVE-2026-84649?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84641A malicious IMAP server can trigger use-after-free and heap-…7.5
- CVE-2026-84642The values of the mail.allowed_attachment_hostnames advanced…7.5
- CVE-2026-84645In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objec…8.8
- CVE-2026-84646In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user …4.3
- CVE-2026-84647In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093…8.8
- CVE-2026-84648In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the s…8.8
- CVE-2026-84650In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, trans…8.8
- CVE-2026-84651In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the R…6.3
- CVE-2026-84652In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenki…7.3
- CVE-2026-84653Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 th…3.5
- CVE-2026-84654In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093…5.4
- CVE-2026-84655Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not …4.3
Are you affected by CVE-2026-84649?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST