CVE-2026-84648

Jenkins contains a stored cross-site scripting (XSS) vulnerability in its system log viewer, which does not escape log record metadata such as the log source, level, and timestamp. An attacker who controls an agent (build node) process can get crafted metadata written into the system log, and the injected script then executes in the browser of any user who later views those log records. Successful exploitation lets the attacker act with the privileges of the viewing user, potentially performing controller administrative actions or hijacking their session. All Jenkins 2.579 and earlier and LTS 2.568.2 and earlier are affected, although the attacker must already control an agent process. No exploitation in the wild, public proof-of-concept, or KEV listing is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to a fixed Jenkins release, i.e. any weekly version later than 2.579 or any LTS version later than 2.568.2. Until patched, restrict which users can connect or control agent processes and limit who can view the system log. Audit agent access credentials and recent log records for signs that an agent-supplied source, level, or timestamp was tampered with.