Jenkins: config.xml nested objects reachable via Stapler give authenticated users remote code execution

Impact

Objects whose configuration normally lives in independent top-level files - the global configuration, jobs - can be smuggled in as nested field values inside a user-submitted config.xml, after which they handle HTTP requests through Stapler and yield remote code execution on the controller. A Jenkins controller in a GPU shop is a credential concentrator: kubeconfigs for the training clusters, registry push credentials, cloud service accounts, and node SSH keys typically all sit on it. Code execution there is not one host compromised, it is the ability to push a poisoned image or manifest that every GPU node will pull on the next rollout. Affects Jenkins 2.579 and earlier and LTS 2.568.2 and earlier.

Who can reach it

An authenticated user who can submit a config.xml - i.e. holds job-configure level access on the controller. No user interaction required. Any Jenkins instance where tenants or ML engineers self-serve pipeline configuration should treat this as reachable.

What to do

Upgrade the Jenkins controller past 2.579 (LTS past 2.568.2) per the advisory and restart it; the record does not name the fixed release. A controller upgrade is a short CI outage - queued builds pause, running GPU jobs already dispatched to the fleet are unaffected. No node drain or reboot is needed.

References

Related entries

• Jenkins Stapler: form data binding instantiates configuration types the target field never expectedCVE-2026-84647 · Jenkins Stapler (form data binding type restriction)High
• Jenkins: unescaped system log metadata lets an agent-controlled process store XSS in the controller UICVE-2026-84648 · Jenkins controller (system log viewer, log record metadata escaping)High
• Jenkins Stapler: CSRF crumb embedded in generated JavaScript leaks to same-site attackersCVE-2026-84649 · Jenkins Stapler (dynamically generated JavaScript endpoint, CSRF crumb)High
• Jenkins: transient fields cannot be excluded from deserialization of submitted configurationCVE-2026-84650 · Jenkins controller (XStream configuration deserialization, transient fields)High
• Jenkins SAML Plugin: IdP metadata file overwritable via data binding, allowing login as any userCVE-2026-84668 · Jenkins SAML Plugin (IdP metadata file, Stapler data binding)High
• Jenkins Allure Plugin: path traversal lets Item/Read users read arbitrary controller filesCVE-2026-84669 · Jenkins Allure Plugin (report path handling)High