# CVE-2026-84649: Stapler CSRF token exposure in dynamically generated JavaScript

Source: https://junglewise.ai/threats/cve-2026-84649-stapler-csrf-token-exposure-in-dynamically-generated-javascript  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84649 · Severity: high · CVSS 8.8 · Published 2026-09-02

Jenkins uses a web framework called Stapler to handle HTTP requests and serve dynamic content. The framework generates JavaScript resources that contain a user's CSRF protection token (crumb) as plain text. An attacker who can host a malicious page on the same domain as Jenkins can steal a victim's token and perform unauthorized actions, such as creating users, modifying configurations, or triggering jobs.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-84649 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84649 being exploited in the wild.

**How severe is CVE-2026-84649?** High severity, with a CVSS score of 8.8, published 2 September 2026.

**Which products and versions are affected?** Jenkins 2.447 through 2.579, LTS 2.452.1 through 2.568.2.

**Is there a fix for CVE-2026-84649?** A patch was published on 2026-09-02: Fixed in Jenkins 2.580 and LTS 2.568.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84649 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84649?** Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Stapler's dynamically generated JavaScript endpoint, which embeds the CSRF token (crumb) as a string literal in the response. Attackers with control over a page hosted on the same site as Jenkins (e.g., a sibling subdomain sharing the parent domain) can load this JavaScript resource via a script tag, extracting the token from the response. The token can then be used to forge requests on behalf of the targeted user. Affected Stapler versions range from 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6), included in Jenkins 2.447–2.579 and LTS 2.452.1–2.568.2. The attack requires no authentication but typically requires user interaction (visiting a malicious page). Patches are available in Jenkins 2.580 and LTS 2.568.3.

## Affected products

- Jenkins Jenkins 2.447 through 2.579, LTS 2.452.1 through 2.568.2
- Cloudbees Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6)

## Timeline

- 2026-09-02: disclosed: CVE-2026-84649 published in Jenkins Security Advisory 2026-09-02
- 2026-09-02: patched: Fixed in Jenkins 2.580 and LTS 2.568.3

## References

- [https://www.jenkins.io/security/advisory/2026-09-02/](https://www.jenkins.io/security/advisory/2026-09-02/)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)