Quick answers
- Is CVE-2026-84658 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84658 being exploited in the wild.
- How severe is CVE-2026-84658?
- Medium severity, with a CVSS score of 4.3, published 2 September 2026.
- Which products and versions are affected?
- Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier.
- Is there a fix for CVE-2026-84658?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-84658 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84658?
- Check whether you run Jenkins Script Security Plugin or Jenkins Script Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Jenkins Script Security Plugin uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing Stapler form data binding to instantiate the configuration object from user-submitted forms. An attacker with Overall/Read permission can craft a form submission specifying the vulnerable constructor to instantiate and read the script approval configuration that would normally be restricted. The vulnerability requires network access and authenticated read-level permissions. Successful exploitation allows an attacker to read sensitive configuration data used to control script execution policies in Jenkins, potentially informing further attacks on script security controls.
Affected products
- Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: advisory: Jenkins Security Advisory 2026-09-02