CVE-2026-84670
Received Received - Intake

Arbitrary Code Execution in Jenkins Performance Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Jenkins Project

Description
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84670
EUVD
EUVD-2026-70140

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkinsci performance_plugin to 1015.v09ca_52b_3370e (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Jenkins Performance Plugin versions 1015.v09ca_52b_3370e and earlier have a deserialization vulnerability. When cached performance reports are stored in the build directory on the Jenkins controller, the plugin does not restrict which classes can be instantiated during deserialization. This allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Impact Analysis

If you use Jenkins Performance Plugin versions 1015.v09ca_52b_3370e or earlier, an attacker with Item/Configure permission could exploit this to run malicious code on your Jenkins controller. This could lead to unauthorized access, data theft, or disruption of Jenkins services.

Compliance Impact

This vulnerability allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or health data.

Mitigation Strategies

Upgrade Jenkins Performance Plugin to a version later than 1015.v09ca_52b_3370e to address the deserialization flaw. Restrict Item/Configure permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart