Jenkins Stapler: form binding writes public static fields, applying changes instance-wide

Impact

Stapler's form data binding allows a submitted form to set public static fields on the configuration object it binds to. Static state is per-JVM, so a value set through a per-job or per-plugin form takes effect across the whole Jenkins instance rather than the object the submitter is entitled to edit. Which fields are actually reachable depends on the plugins installed; the advisory does not enumerate an escalation path and Jenkins scores it 5.4 with low confidentiality and integrity, so treat this as a privilege boundary failure between job owners and the controller administrator rather than a proven code-execution route. On a shared controller that schedules GPU work, that boundary is what keeps one team from changing settings the whole fleet's pipelines depend on.

Who can reach it

Authenticated Jenkins user who can submit any configuration form - typically Item/Configure or an equivalent per-plugin permission. Network reachable, no administrator rights, no user interaction.

What to do

Upgrade Jenkins past 2.579 weekly and LTS 2.568.2, which bundle a fixed Stapler; the record names Stapler 2107.v8dfcb_e8ed317 and earlier as affected, except 2088.2093.vd7c3e58008a_6. See SECURITY-3926 in the 2026-09-02 advisory. Cost is a controller JVM restart - running builds abort, agents reconnect automatically, and no GPU node is touched. Narrowing who holds configure permissions reduces exposure in the meantime.

References

Related entries

• Jenkins Pipeline: Build Step Plugin: downstream builds canceled without Item/Cancel permissionCVE-2026-84660 · Jenkins Pipeline: Build Step Plugin (build and waitForBuild step cancellation)Medium
• CloudNativePG instance manager (status server, TCP/8000 control endpoints): A set of operator-only control endpointsNCVD-2026-050-cloudnativepg-instance-manager-s · CloudNativePG instance manager (status server, TCP/8000 control endpoints)Medium
• Slurm (user_name / gid field handling): Slurm trusts the user_name and gid fields carried in job RPCs instead ofCVE-2018-10995 · Slurm (user_name / gid field handling)Medium
• IBM Spectrum LSF (job submission, file permissions): Weak file permissions in the LSF install let a local user changeCVE-2018-1724 · IBM Spectrum LSF (job submission, file permissions)Medium
• AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016): Insufficient RMP checking on IOMMU host bufferCVE-2023-20585 · AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016)Medium
• ZKTeco BioAccess IVS v3.3.1 access control platform: An unauthenticated attacker can open and close any doorCVE-2023-38958 · ZKTeco BioAccess IVS v3.3.1 access control platformMedium