CVE-2026-84654: Stapler form data binding allows setting public static fields in Jenkins

CVE-2026-84654 · Severity: medium · CVSS 5.4 · Published 2026-09-02

Stapler, a web framework used by Jenkins for handling HTTP requests, contains a vulnerability in its form data binding logic that allows attackers to modify public static fields in configuration objects globally across the Jenkins instance. An attacker with permission to submit configuration forms can exploit this to make changes that affect all Jenkins users and jobs, potentially disrupting operations or gaining unauthorized control.

Quick answers

Is CVE-2026-84654 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84654 being exploited in the wild.
How severe is CVE-2026-84654?
Medium severity, with a CVSS score of 5.4, published 2 September 2026.
Which products and versions are affected?
CloudBees Jenkins 2.579 and earlier, LTS 2.568.2 and earlier; CloudBees Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6.
Is there a fix for CVE-2026-84654?
A patch was published on 2026-09-02: Fixed in Jenkins 2.580 and LTS 2.568.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84654 attacked?
It is attacked over the network.
Am I affected by CVE-2026-84654?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Stapler's form data binding mechanism allows attackers to set public static fields on bound configuration objects without proper type validation or field-access restrictions. The vulnerability exists in Stapler versions 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6) and affects Jenkins 2.579 and earlier, plus LTS 2.568.2 and earlier. An attacker with Overall/Read permission who can submit configuration forms can exploit this to modify static fields that are shared globally across the Jenkins instance. The attack requires network access and authentication to submit forms, but does not require code execution. Jenkins 2.580 and LTS 2.568.3 fix this by restricting form data binding to only instantiate types compatible with the expected field type.

Affected products

  • CloudBees Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
  • CloudBees Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6

Timeline

  • 2026-09-02: disclosed: Published in Jenkins Security Advisory 2026-09-02
  • 2026-09-02: patched: Fixed in Jenkins 2.580 and LTS 2.568.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.