Jenkins Stapler: form binding writes public static fields, applying changes instance-wide

Impact

Stapler's form data binding allows a submitted form to set public static fields on the configuration object it binds to. Static state is per-JVM, so a value set through a per-job or per-plugin form takes effect across the whole Jenkins instance rather than the object the submitter is entitled to edit. Which fields are actually reachable depends on the plugins installed; the advisory does not enumerate an escalation path and Jenkins scores it 5.4 with low confidentiality and integrity, so treat this as a privilege boundary failure between job owners and the controller administrator rather than a proven code-execution route. On a shared controller that schedules GPU work, that boundary is what keeps one team from changing settings the whole fleet's pipelines depend on.

Who can reach it

Authenticated Jenkins user who can submit any configuration form - typically Item/Configure or an equivalent per-plugin permission. Network reachable, no administrator rights, no user interaction.

What to do

Upgrade Jenkins past 2.579 weekly and LTS 2.568.2, which bundle a fixed Stapler; the record names Stapler 2107.v8dfcb_e8ed317 and earlier as affected, except 2088.2093.vd7c3e58008a_6. See SECURITY-3926 in the 2026-09-02 advisory. Cost is a controller JVM restart - running builds abort, agents reconnect automatically, and no GPU node is touched. Narrowing who holds configure permissions reduces exposure in the meantime.

References

Related entries

• Jenkins Pipeline: Build Step Plugin: downstream builds cancelled without Item/Cancel permission checkCVE-2026-84660 · Jenkins Pipeline: Build Step Plugin (build and waitForBuild step cancellation)Medium
• Jenkins Pipeline: Groovy Libraries plugin: CSRF lets an unauthenticated attacker delete library cachesCVE-2026-84663 · Jenkins Pipeline: Groovy Libraries Plugin (shared library cache deletion endpoint)Medium
• Jenkins GitLab plugin: global connection URL can be overwritten, sending admin API tokens to an attackerCVE-2026-84664 · Jenkins GitLab Plugin (global connection configuration via Stapler data binding)Medium
• Jenkins Job Configuration History Plugin: attackers redirect history storage to a directory of their choosingCVE-2026-84666 · Jenkins Job Configuration History Plugin (history recording config via Stapler data binding)Medium
• Jenkins XL Deploy plugin: any user with Overall/Read can enumerate stored credential IDsCVE-2026-84674 · Jenkins XebiaLabs XL Deploy Plugin (credentials ID enumeration)Medium
• Jenkins update-center2: unescaped plugin metadata gives stored XSS on plugin download index pagesCVE-2026-84677 · Jenkins update-center2 (plugin metadata escaping on download index pages)Medium