CVE-2026-84646
Received Received - Intake

Jenkins User Object Creation via Malicious XML Deserialization

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Jenkins Project

Description
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84646
EUVD
EUVD-2026-70112

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jenkins jenkins to 2.580 (exc)
jenkins jenkins_lts to 2.569 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Jenkins allows attackers with Overall/Read permission to create user objects by submitting crafted XML. The issue occurs because user objects can appear as nested field values in other deserialized XML objects in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier.

Impact Analysis

An attacker could exploit this to create unauthorized user accounts with Overall/Read permissions, potentially gaining access to sensitive data or system functions. This could lead to data breaches or unauthorized modifications in the Jenkins environment.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. Unauthorized user creation may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade Jenkins to a version later than 2.579 or LTS 2.568.2 to address the deserialization flaw in user objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart