CVE-2026-84649
Received Received - Intake

CSRF Token Exposure in Jenkins Stapler

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Jenkins Project

Description
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84649
EUVD
EUVD-2026-70115

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
stapler stapler From 1839.ved17667b_a_eb_5 (inc) to 2107.v8dfcb_e8ed317 (inc)
jenkins jenkins From 2.447 (inc) to 2.579 (inc)
jenkins jenkins From 2.452.1 (inc) to 2.568.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Jenkins and its Stapler library versions. An HTTP endpoint serving JavaScript resources includes the user's CSRF token (crumb) as a string literal. Attackers with control over a page on the same site can extract this token and perform actions on behalf of the user.

Detection Guidance

This vulnerability involves a CSRF token (crumb) being exposed in dynamically generated JavaScript resources in Stapler versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, except 2088.2093.vd7c3e58008a_6. Detection requires checking Jenkins and Stapler versions. Verify if your Jenkins instance falls within the affected version range (2.447 to 2.579 or LTS 2.452.1 to 2.568.2).

Commands to check versions: For Jenkins, check the version in the web interface under 'Manage Jenkins' > 'System Information'. For Stapler, inspect the JavaScript resources served by Jenkins for embedded crumb tokens in responses.

Impact Analysis

If exploited, attackers could perform unauthorized actions on your Jenkins account, such as modifying configurations, triggering builds, or accessing sensitive data. This requires the attacker to control a page on the same site as Jenkins.

Mitigation Strategies

Upgrade Jenkins and Stapler to versions outside the affected range. Specifically, upgrade to Jenkins 2.580 or later, or LTS 2.569.3 or later. This resolves the issue by removing the vulnerable Stapler versions included in those Jenkins releases.

If upgrading is not immediately possible, restrict access to the Jenkins web interface to trusted networks or users to limit exposure. Monitor for unusual activity or unauthorized actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart