Jenkins Core and Plugins Plagued by Multiple High-Severity Vulnerabilities
Jenkins has issued a critical security advisory detailing numerous vulnerabilities in its core software and a wide array of plugins, with several rated as High severity.
Jenkins, a widely-used open-source automation server, is facing a significant security challenge with the disclosure of multiple vulnerabilities affecting both its core platform and numerous associated plugins. The advisory, released on September 2, 2026, highlights critical flaws that could lead to remote code execution and unauthorized access if not promptly addressed.
The most severe of these vulnerabilities, identified as SECURITY-3972 (CVE-2026-84645), is a deserialization flaw within Jenkins core. This vulnerability arises from how Jenkins handles serialized data using XStream. While Jenkins employs a custom deserialization filter (JEP-200) to mitigate common risks, a flaw in this mechanism allows attackers to exploit nested field values in user-submitted configuration files. By crafting specific objects, attackers can gain access to an improperly protected Script Console, ultimately leading to remote code execution on the Jenkins server. This issue affects Jenkins versions 2.579 and earlier, and LTS versions 2.568.2 and earlier.
Another high-severity vulnerability, SECURITY-3915 (CVE-2026-84647), stems from the Stapler web framework, which Jenkins uses for HTTP request handling. Stapler's form data binding mechanism, in certain versions (Stapler 2107.v8dfcb_e8ed317 and earlier, excluding specific patches), does not adequately restrict the types of objects that can be instantiated via form submissions. This allows authenticated attackers with Overall/Read permission to instantiate unintended configuration-related types, potentially leading to system compromise.
Furthermore, a stored cross-site scripting (XSS) vulnerability, SECURITY-3967 (CVE-2026-84648), has been identified in the system log viewer. In affected versions (Jenkins 2.579 and earlier, LTS 2.568.2 and earlier), the log record metadata is not properly escaped, making it possible for attackers who control agent processes to inject malicious scripts that execute within the browser of users viewing the logs.
The advisory also details a high-severity cross-origin exposure of the CSRF token (SECURITY-3878, CVE-2026-84649). This vulnerability in the Stapler web framework allows attackers to obtain a valid CSRF token (crumb) by loading dynamically generated JavaScript resources. If Jenkins is hosted on a subdomain of the same site as other services, an attacker could potentially use this crumb to perform actions on behalf of a logged-in user on those sibling services.
Beyond these critical issues, medium-severity flaws such as SECURITY-3908 (CVE-2026-84646), which allows for the creation of user objects via crafted XML, and vulnerabilities in numerous plugins including Allure, GitLab, LDAP, Microsoft Entra ID, and Script Security, are also addressed. These plugin-specific issues could expose users to various risks depending on the plugin's functionality and configuration.
Jenkins has released updates to address these vulnerabilities. Jenkins 2.580 and LTS 2.568.3 contain fixes for the core vulnerabilities, including changes to deserialization filters and Stapler's behavior. Plugin maintainers have also released updated versions. Users are strongly urged to update their Jenkins instances and all installed plugins to the latest available versions as soon as possible to mitigate these risks. Administrators unable to update immediately are advised to consult the advisory for specific mitigation steps, such as disabling certain features or removing vulnerable plugins where applicable.