Jenkins Patches RCE Flaw and 30+ Vulnerabilities

Notable CVEs

TL;DR

Jenkins shipped a large security advisory on September 2, 2026. It fixes more than 30 CVEs across Jenkins core and many plugins. The most serious Jenkins vulnerability, CVE-2026-84645, allows remote code execution through unsafe deserialization. No exploitation in the wild has been confirmed for these issues.

Why It Matters

Jenkins is one of the most widely used open-source automation servers. It sits at the heart of countless CI/CD pipelines. Therefore, a controller compromise can expose source code, secrets, and deployment access.

This Jenkins vulnerability set spans core and popular plugins. Many flaws need only low-privilege access. As a result, an attacker with a foothold could escalate toward full control.

The Headline Flaw: CVE-2026-84645

The most severe issue is a deserialization vulnerability rated High. Jenkins saves configuration using XStream serialization. A custom filter normally blocks unsafe types.

However, in Jenkins 2.579 and earlier, certain config-storing objects slipped through. A crafted config.xml could nest these objects as field values. They could then handle HTTP requests through the Stapler framework. A tuned combination reaches an improperly protected Script Console, which enables remote code execution.

Other High-Severity Issues

Several more High-rated flaws stand out. CVE-2026-84647 lets low-privilege users instantiate configuration types via Stapler form binding. CVE-2026-84649 exposes a user’s CSRF token to sibling subdomains. CVE-2026-84652 is a session fixation bug in the “remember me” flow.

Plugin flaws add further risk. CVE-2026-84668 in the SAML Plugin could let an attacker overwrite identity provider metadata and log in as any user. CVE-2026-84671 in the File Parameter Plugin allows path traversal that can lead to remote code execution.

How the Attacks Work

Most flaws abuse the Stapler web framework and its data binding. Stapler builds objects from form submissions and config files. When type restrictions are missing, attackers instantiate unintended objects.

From there, impact varies by flaw. Some enable stored XSS through unescaped metadata. Others allow SSRF, arbitrary file writes, or configuration overwrites. This report describes mechanisms only and withholds any exploit code.

Exploitation Status

The Jenkins security team reports no active exploitation of these flaws. Likewise, no public proof-of-concept has been confirmed. Most issues came through the Jenkins Bug Bounty Program sponsored by the European Commission. Still, given the RCE potential, prompt patching remains wise.

Affected Versions

Core flaws affect Jenkins weekly up to and including 2.579. They also affect Jenkins LTS up to and including 2.568.2. Many plugins are affected at specific versions, including SAML, File Parameter, Performance, Allure, ThinBackup, and SonarQube Scanner.

Patch and Mitigation Steps

Update Jenkins weekly to 2.580 or LTS to 2.568.3. Then update each affected plugin to its fixed release. You can review the complete Jenkins security advisory for September 2, 2026 for exact versions.

Notes and Exceptions

Some flaws have interim mitigations. For the CSRF token exposure, admins can disable the Resource Root URL or host it on a separate domain. One plugin still lacks a fix: the Parameterized Remote Trigger Plugin, which stores tokens in plain text. Watch for its update.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.