# CVE-2026-84652: Jenkins session fixation via remember me cookie

Source: https://junglewise.ai/threats/cve-2026-84652-jenkins-session-fixation-via-remember-me-cookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84652 · Severity: high · CVSS 7.3 · Published 2026-09-02

Jenkins is an automation server used to build, test, and deploy software. A flaw in the "remember me" login feature allows attackers to pre-set a session cookie in a victim's browser; when the victim logs in via "remember me," the attacker gains unauthorized access to Jenkins and can view sensitive projects, trigger builds, or modify configurations depending on the victim's permissions.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-84652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84652 being exploited in the wild.

**How severe is CVE-2026-84652?** High severity, with a CVSS score of 7.3, published 2 September 2026.

**Which products and versions are affected?** Jenkins 2.579 and earlier, LTS 2.568.2 and earlier.

**Is there a fix for CVE-2026-84652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84652 attacked?** It is attacked from the adjacent network or over the network.

**Am I affected by CVE-2026-84652?** Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Jenkins fails to rotate the session identifier when a user authenticates via the "remember me" cookie mechanism. An attacker able to serve content on the same site as Jenkins (e.g., a sibling subdomain or shared domain) can inject a known session cookie into the victim's browser. When the victim later authenticates using the "remember me" feature, the pre-set session cookie remains valid, allowing the attacker to hijack the authenticated session without knowing the victim's credentials. This is a session fixation attack requiring an attacker with some control over the Jenkins hosting domain or network position to inject cookies. The attack is partially mitigated in environments with strict cookie policies, but affects Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier.

## Affected products

- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: advisory

## References

- [https://www.jenkins.io/security/advisory/2026-09-02/](https://www.jenkins.io/security/advisory/2026-09-02/)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)