Executive brief
Jenkins uses a web framework called Stapler to handle HTTP requests and serve dynamic content. The framework generates JavaScript resources that contain a user's CSRF protection token (crumb) as plain text. An attacker who can host a malicious page on the same domain as Jenkins can steal a victim's token and perform unauthorized actions, such as creating users, modifying configurations, or triggering jobs.
Technical details
The vulnerability exists in Stapler's dynamically generated JavaScript endpoint, which embeds the CSRF token (crumb) as a string literal in the response. Attackers with control over a page hosted on the same site as Jenkins (e.g., a sibling subdomain sharing the parent domain) can load this JavaScript resource via a script tag, extracting the token from the response. The token can then be used to forge requests on behalf of the targeted user. Affected Stapler versions range from 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.447–2.579 and LTS 2.452.1–2.568.2. The attack requires no authentication but typically requires user interaction (visiting a malicious page). Patches are available in Jenkins 2.580 and LTS 2.568.3.
Affected products
- Jenkins Jenkins 2.447 through 2.579, LTS 2.452.1 through 2.568.2
- Cloudbees Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6)
Timeline
- 2026-09-02: disclosed: CVE-2026-84649 published in Jenkins Security Advisory 2026-09-02
- 2026-09-02: patched: Fixed in Jenkins 2.580 and LTS 2.568.3