Jenkins core: unescaped map keys let a user inject arbitrary fields into JSON and Python API responses

Impact

Map keys are not escaped when Jenkins serializes objects as JSON or Python through its REST API, so a user who controls a map property name - a job parameter name, a build variable, an axis label - injects arbitrary fields into what the API returns. The people hurt are the consumers: deployment scripts, schedulers and dashboards that poll the Jenkins API and act on parsed fields will read attacker-chosen keys as if Jenkins produced them. On a GPU fleet where automation reads Jenkins to decide what to build, where to deploy and which node pool to target, that is a way to steer downstream tooling without touching the controller's own permissions. Jenkins scores it integrity-low. Affects Jenkins 2.579 and earlier and LTS 2.568.2 and earlier.

Who can reach it

An authenticated Jenkins user with low privileges who can control a map property name that ends up in an API response. No administrative rights required.

What to do

Upgrade the controller to the release named in the 2026-09-02 Jenkins advisory (SECURITY-3879); the record does not state a fixed version, so take it from the advisory. Cost is a controller restart - short CI outage, agents reconnect, running builds lost unless drained. No GPU node impact. Where automation consumes the Jenkins REST API, treat responses from an unpatched controller as untrusted structure and validate expected fields rather than trusting the whole object.

References

Related entries

• Jenkins core: missing permission check exposes build parameters of jobs a user cannot otherwise seeCVE-2026-84656 · Jenkins core (build parameter access, missing Item/Read permission check)Medium
• Jenkins Script Security Plugin: form submission exposes the script approval configuration to attackersCVE-2026-84658 · Jenkins Script Security Plugin (script approval configuration)Medium
• Jenkins Script Security Plugin: missing permission check lets attackers disable global sandbox enforcementCVE-2026-84659 · Jenkins Script Security Plugin (global sandbox enforcement setting)Medium
• Jenkins LDAP plugin: Stapler data binding lets a low-privileged user make the controller connect to any URLCVE-2026-84662 · Jenkins LDAP plugin (Stapler data binding, attacker-specified connection URL)Medium
• Jenkins Parameterized Remote Trigger plugin: remote trigger tokens stored unencrypted in job config.xmlCVE-2026-84676 · Jenkins Parameterized Remote Trigger plugin (tokens stored unencrypted in job config.xml)Medium
• GitLab CE/EE: developer-role user can modify package registry metadata without maintainer rightsCVE-2026-8667 · GitLab CE/EE (package registry metadata authorization)Medium