Executive brief
Stapler, a web framework used by Jenkins for handling HTTP requests, contains a vulnerability in its form data binding logic that allows attackers to modify public static fields in configuration objects globally across the Jenkins instance. An attacker with permission to submit configuration forms can exploit this to make changes that affect all Jenkins users and jobs, potentially disrupting operations or gaining unauthorized control.
Technical details
Stapler's form data binding mechanism allows attackers to set public static fields on bound configuration objects without proper type validation or field-access restrictions. The vulnerability exists in Stapler versions 2107.v8dfcb_e8ed317 and earlier (except 2088.2093.vd7c3e58008a_6) and affects Jenkins 2.579 and earlier, plus LTS 2.568.2 and earlier. An attacker with Overall/Read permission who can submit configuration forms can exploit this to modify static fields that are shared globally across the Jenkins instance. The attack requires network access and authentication to submit forms, but does not require code execution. Jenkins 2.580 and LTS 2.568.3 fix this by restricting form data binding to only instantiate types compatible with the expected field type.
Affected products
- CloudBees Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
- CloudBees Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6
Timeline
- 2026-09-02: disclosed: Published in Jenkins Security Advisory 2026-09-02
- 2026-09-02: patched: Fixed in Jenkins 2.580 and LTS 2.568.3