# CVE-2026-84647: Stapler type instantiation bypass in Jenkins

Source: https://junglewise.ai/threats/cve-2026-84647-stapler-type-instantiation-bypass-in-jenkins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84647 · Severity: high · CVSS 8.8 · Published 2026-09-02

Stapler, the web framework used by Jenkins (an automation server managing continuous integration/deployment), fails to restrict object types that can be created from form data. An attacker with basic read access can exploit this to instantiate configuration objects they shouldn't be able to create, potentially gaining control over system settings or executing arbitrary code.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins), [Stapler](https://junglewise.ai/threats/technologies/stapler). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Stapler](https://junglewise.ai/threats/vendors/stapler).

## Quick answers

**Is CVE-2026-84647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84647 being exploited in the wild.

**How severe is CVE-2026-84647?** High severity, with a CVSS score of 8.8, published 2 September 2026.

**Which products and versions are affected?** Jenkins 2.579 and earlier, LTS 2.568.2 and earlier; Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6.

**Is there a fix for CVE-2026-84647?** A patch was published on 2026-09-02: Jenkins 2.580, LTS 2.568.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84647 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84647?** Check whether you run Jenkins or Stapler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a type restriction bypass in Stapler's form data binding logic (SECURITY-3915). Stapler instantiates configuration objects based on types specified in form submissions without validating that the instantiated type is compatible with the expected field type. An attacker with Overall/Read permission can submit crafted form data containing any configuration-related type, not just those intended for that specific field. This allows instantiation of arbitrary configuration objects (e.g., security realm, agent launcher) that may have security implications. The fix in Jenkins 2.580 and LTS 2.568.3 enforces strict type compatibility checking in Stapler's form binding.

## Affected products

- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
- Stapler Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: Jenkins 2.580, LTS 2.568.3

## References

- [https://www.jenkins.io/security/advisory/2026-09-02/](https://www.jenkins.io/security/advisory/2026-09-02/)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)