Jenkins core: crafted XML submission lets a read-only user create user objects on the controller

Impact

User objects can appear as nested field values inside other deserialized XML objects, so anyone with Overall/Read can create user records on the controller by submitting crafted XML. The direct effect is integrity of the user database rather than access: an attacker seeds accounts of their choosing, which pollutes authorization records and can pre-create an identity that a later authentication or SSO mapping resolves onto. On a controller that holds registry and cluster credentials for a GPU fleet, this is a precursor rather than a takeover - Jenkins scores it 4.3, integrity-low, no confidentiality or availability impact - but it is a write primitive handed to an account that should only be able to read. Affects Jenkins 2.579 and earlier and LTS 2.568.2 and earlier.

Who can reach it

Any authenticated Jenkins user with Overall/Read permission who can submit XML to the controller. No administrative rights needed.

What to do

Upgrade the controller to the release named in the 2026-09-02 Jenkins advisory (SECURITY-3908); the record does not state the fixed version, so take it from the advisory. Cost is a controller restart - queue pauses, agents reconnect, running builds lost unless drained. No fleet impact. After upgrading, review the user list for accounts created since the controller went into service, since the upgrade does not remove anything already seeded.

References

Related entries

• Jenkins core: unescaped map keys let a user inject arbitrary fields into JSON and Python API responsesCVE-2026-84655 · Jenkins core (REST API JSON and Python serialization, unescaped map keys)Medium
• Jenkins core: missing permission check exposes build parameters of jobs a user cannot otherwise seeCVE-2026-84656 · Jenkins core (build parameter access, missing Item/Read permission check)Medium
• Jenkins Script Security Plugin: form submission exposes the script approval configuration to attackersCVE-2026-84658 · Jenkins Script Security Plugin (script approval configuration)Medium
• Jenkins Script Security Plugin: missing permission check lets attackers disable global sandbox enforcementCVE-2026-84659 · Jenkins Script Security Plugin (global sandbox enforcement setting)Medium
• Jenkins LDAP plugin: Stapler data binding lets a low-privileged user make the controller connect to any URLCVE-2026-84662 · Jenkins LDAP plugin (Stapler data binding, attacker-specified connection URL)Medium
• Jenkins Parameterized Remote Trigger plugin: remote trigger tokens stored unencrypted in job config.xmlCVE-2026-84676 · Jenkins Parameterized Remote Trigger plugin (tokens stored unencrypted in job config.xml)Medium