CVE-2026-84650

Analyzed Analyzed - Analysis Complete

Jenkins Deserialization Flaw Allows Configuration Manipulation

Publication date: 2026-09-02

Last updated on: 2026-09-11

Assigner: Jenkins Project

Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-02

Last Modified

2026-09-11

Generated

2026-09-23

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-21

NVD

CVE-2026-84650

EUVD

EUVD-2026-70116

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	jenkins	to 2.580 (exc)
jenkins	jenkins	to 2.568.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-566	The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Attack-Flow Graph

Executive Summary

In Jenkins versions 2.579 and earlier, including LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization. This means attackers who can submit configuration updates may set values for transient fields that will be deserialized, with the impact depending on how those fields are used in the system.

Detection Guidance

This vulnerability involves insecure deserialization in Jenkins due to improper handling of transient fields. To detect it, inspect Jenkins configuration updates for unexpected field values, particularly those marked as transient. Check logs for deserialization errors or unusual field assignments. No specific commands are provided in the context, but monitor for anomalies in submitted configurations and review deserialization-related logs.

Impact Analysis

Attackers could manipulate transient fields during deserialization to alter application behavior, potentially leading to unauthorized access, data leaks, or system compromise depending on how those fields are utilized in Jenkins configurations.

Compliance Impact

The vulnerability allows attackers to manipulate deserialized transient fields in Jenkins, which could lead to unauthorized data exposure or modification. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Jenkins to version 2.580 or later for the weekly release, or to LTS 2.568.3 or later for the long-term support release to address the deserialization issue.

Hi! I’m here to help you understand CVE-2026-84650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70