CVE-2026-84655

Analyzed Analyzed - Analysis Complete

Jenkins REST API Object Serialization Injection

Publication date: 2026-09-02

Last updated on: 2026-09-15

Assigner: Jenkins Project

Description

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-02

Last Modified

2026-09-15

Generated

2026-09-23

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-21

NVD

CVE-2026-84655

EUVD

EUVD-2026-70121

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	jenkins	to 2.579 (inc)
jenkins	jenkins	to 2.568.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

Jenkins versions 2.579 and earlier, including LTS 2.568.2 and earlier, have a flaw where map keys are not properly escaped during JSON and Python serialization in the REST API. This allows attackers who control map property names to inject arbitrary fields into API responses.

Detection Guidance

This vulnerability can be detected by checking Jenkins instances for versions 2.579 or earlier and LTS 2.568.2 or earlier. Inspect REST API responses for unexpected field injections in JSON or Python formats. Verify if map keys in API responses are properly escaped.

Impact Analysis

Attackers could manipulate API responses to include malicious data, potentially leading to misinformation, unauthorized access, or further exploitation of systems relying on Jenkins API responses.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive data through JSON and Python API responses. Attackers may inject arbitrary fields into these responses, potentially leaking confidential information. This could violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Mitigation Strategies

Upgrade Jenkins to version 2.580 or later, or LTS 2.568.3 or later, as these versions address the JSON and Python API response injection issue.

Hi! I’m here to help you understand CVE-2026-84655. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70