GPU VulnDB

Database/Control plane, storage & DevOps

Jenkins TICS plugin: attacker-controlled build variables execute arbitrary commands on the build agent

CVE-2026-84675Control plane, storage & DevOpscurated

Impact

The plugin assembles an OS command from build environment variable values without escaping them, so anyone who can influence those values - a job parameter, an SCM-supplied variable - runs arbitrary commands as the agent user on whatever machine executes the build. Jenkins scores it scope-changed at 7.4, reflecting that the code runs outside the controller's own security boundary. Where build agents are GPU nodes, or share credentials and network reachability with them, this is code execution on a fleet machine obtained from a job configuration rather than from any shell access. The blast radius is whatever that agent holds: workspace secrets, mounted registry credentials, node-level cluster access. Only controllers with the TICS plugin installed are affected - it is an optional code-quality integration, not Jenkins core.

Who can reach it

Remote authenticated Jenkins user with low privileges (PR:L) who can set or influence build environment variable values on a job that uses the TICS plugin. No shell access to the agent is required.

What to do

Upgrade the TICS plugin past 2025.1.1 per SECURITY-3987 in the 2026-09-02 Jenkins advisory; the advisory names 2025.1.1 and earlier as affected without stating a fixed release number, so take the current plugin version. Cost is a controller restart to load the plugin - queue pauses, agents reconnect, running builds lost unless drained. If TICS is not actually in use on this controller, uninstalling the plugin removes the exposure outright and is the cheaper move.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-84675https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3987

Related entries

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.