Database/Control plane, storage & DevOps
Jenkins: unescaped system log metadata lets an agent-controlled process store XSS in the controller UI
Impact
The system log viewer does not escape log record metadata - source, level and timestamp - so anyone controlling an agent process can plant script that executes in the browser of an administrator who opens the system log. That is the exact page an operator visits when a build node misbehaves, so the payload fires in an admin session by design rather than by luck. In a GPU fleet the build agents are often the GPU nodes themselves or tenant-adjacent runners, which puts the trigger inside the blast radius rather than outside it: a compromised or malicious agent gets a path to act as a Jenkins administrator. Affects Jenkins 2.579 and earlier, LTS 2.568.2 and earlier.
Who can reach it
An attacker in control of an agent process connected to the controller - no controller account needed. Requires an administrator to view the system log page, so it is not self-firing.
What to do
Upgrade the Jenkins controller per the advisory and restart it; the record does not name the fixed release. Short CI outage only. Until patched, treat the system log page as attacker-influenced content and review which agents are permitted to connect.
References
Related entries
- Jenkins Stapler: CSRF crumb embedded in generated JavaScript leaks to same-site attackersCVE-2026-84649 · Jenkins Stapler (dynamically generated JavaScript endpoint, CSRF crumb)High
- Jenkins: transient fields cannot be excluded from deserialization of submitted configurationCVE-2026-84650 · Jenkins controller (XStream configuration deserialization, transient fields)High
- Jenkins SAML Plugin: IdP metadata file overwritable via data binding, allowing login as any userCVE-2026-84668 · Jenkins SAML Plugin (IdP metadata file, Stapler data binding)High
- Jenkins Allure Plugin: path traversal lets Item/Read users read arbitrary controller filesCVE-2026-84669 · Jenkins Allure Plugin (report path handling)High
- Jenkins Performance Plugin: unsafe deserialization of cached reports gives Item/Configure users RCECVE-2026-84670 · Jenkins Performance Plugin (cached performance report deserialization)High
- Jenkins File Parameter Plugin: arbitrary file write on the controller via data binding leads to RCECVE-2026-84671 · Jenkins File Parameter Plugin (Stapler data binding, file write path)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.