Jenkins Stapler: form data binding instantiates configuration types the target field never expected

Impact

Stapler does not restrict form data binding to objects compatible with the declared field type, so a user with only Overall/Read can cause instantiation of configuration-related types that were never intended for that field. The practical consequence depends on which type is chosen, but the entry point requires only read-level access to the controller, which is the permission level most organisations hand out freely to everyone who looks at build results. On a Jenkins that drives GPU cluster deployments, the controller holds cluster credentials, so any foothold that escalates from read-only towards configuration handling is worth patching promptly. Affects Stapler 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6) as shipped in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier.

Who can reach it

Any authenticated user with Overall/Read on the Jenkins controller. No user interaction required.

What to do

Upgrade Jenkins so it ships a fixed Stapler build, then restart the controller - Stapler is a core library, so there is no plugin-only fix. The record does not name the fixed version; read the advisory. Cost is a short controller outage, no impact on GPU nodes.

References

Related entries

• Jenkins: unescaped system log metadata lets an agent-controlled process store XSS in the controller UICVE-2026-84648 · Jenkins controller (system log viewer, log record metadata escaping)High
• Jenkins Stapler: CSRF crumb embedded in generated JavaScript leaks to same-site attackersCVE-2026-84649 · Jenkins Stapler (dynamically generated JavaScript endpoint, CSRF crumb)High
• Jenkins: transient fields cannot be excluded from deserialization of submitted configurationCVE-2026-84650 · Jenkins controller (XStream configuration deserialization, transient fields)High
• Jenkins SAML Plugin: IdP metadata file overwritable via data binding, allowing login as any userCVE-2026-84668 · Jenkins SAML Plugin (IdP metadata file, Stapler data binding)High
• Jenkins Allure Plugin: path traversal lets Item/Read users read arbitrary controller filesCVE-2026-84669 · Jenkins Allure Plugin (report path handling)High
• Jenkins Performance Plugin: unsafe deserialization of cached reports gives Item/Configure users RCECVE-2026-84670 · Jenkins Performance Plugin (cached performance report deserialization)High