CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScript

CVE-2026-84649 · Severity: high · CVSS 8.8 · Published 2026-09-02

Jenkins uses a web framework called Stapler to handle HTTP requests and serve dynamic content. The framework generates JavaScript resources that contain a user's CSRF protection token (crumb) as plain text. An attacker who can host a malicious page on the same domain as Jenkins can steal a victim's token and perform unauthorized actions, such as creating users, modifying configurations, or triggering jobs.

Technologies: Jenkins. Vendors: Jenkins.

Quick answers

Is CVE-2026-84649 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84649 being exploited in the wild.
How severe is CVE-2026-84649?
High severity, with a CVSS score of 8.8, published 2 September 2026.
Which products and versions are affected?
Jenkins 2.447 through 2.579, LTS 2.452.1 through 2.568.2.
Is there a fix for CVE-2026-84649?
A patch was published on 2026-09-02: Fixed in Jenkins 2.580 and LTS 2.568.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84649 attacked?
It is attacked over the network.
Am I affected by CVE-2026-84649?
Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Stapler's dynamically generated JavaScript endpoint, which embeds the CSRF token (crumb) as a string literal in the response. Attackers with control over a page hosted on the same site as Jenkins (e.g., a sibling subdomain sharing the parent domain) can load this JavaScript resource via a script tag, extracting the token from the response. The token can then be used to forge requests on behalf of the targeted user. Affected Stapler versions range from 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.447–2.579 and LTS 2.452.1–2.568.2. The attack requires no authentication but typically requires user interaction (visiting a malicious page). Patches are available in Jenkins 2.580 and LTS 2.568.3.

Affected products

  • Jenkins Jenkins 2.447 through 2.579, LTS 2.452.1 through 2.568.2
  • Cloudbees Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6)

Timeline

  • 2026-09-02: disclosed: CVE-2026-84649 published in Jenkins Security Advisory 2026-09-02
  • 2026-09-02: patched: Fixed in Jenkins 2.580 and LTS 2.568.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.