Jenkins: transient fields cannot be excluded from deserialization of submitted configuration

Impact

Fields marked transient - which developers use precisely to keep runtime-only state out of persisted configuration - are still populated from user-submitted configuration, letting anyone who can push a configuration update dictate their values. The impact varies with how each transient field is used, so this is a class of exposure across core and plugins rather than one deterministic exploit, and it is the kind of primitive that other Jenkins bugs get chained onto. On a controller that deploys to GPU clusters, the accounts allowed to update job configuration are usually far broader than the accounts anyone intended to be able to influence controller internals. Affects Jenkins 2.579 and earlier, LTS 2.568.2 and earlier.

Who can reach it

Any authenticated user permitted to submit configuration updates on the controller. No user interaction required.

What to do

Upgrade the Jenkins controller per the advisory and restart it; the record does not name the fixed release. Short CI outage. Review which principals hold configure permission in the meantime, since that is the only gate.

References

Related entries

• Jenkins SAML Plugin: IdP metadata file overwritable via data binding, allowing login as any userCVE-2026-84668 · Jenkins SAML Plugin (IdP metadata file, Stapler data binding)High
• Jenkins Allure Plugin: path traversal lets Item/Read users read arbitrary controller filesCVE-2026-84669 · Jenkins Allure Plugin (report path handling)High
• Jenkins Performance Plugin: unsafe deserialization of cached reports gives Item/Configure users RCECVE-2026-84670 · Jenkins Performance Plugin (cached performance report deserialization)High
• Jenkins File Parameter Plugin: arbitrary file write on the controller via data binding leads to RCECVE-2026-84671 · Jenkins File Parameter Plugin (Stapler data binding, file write path)High
• Jenkins Entra ID plugin: a colliding Entra group display name inherits a privileged group's permissionsCVE-2026-84672 · Jenkins Microsoft Entra ID plugin (group authorization by display name)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High