CVE-2026-84649

Jenkins's Stapler framework includes an HTTP endpoint that serves dynamically generated JavaScript and embeds the user's cross-site request forgery (CSRF) protection token (crumb) as a string literal in that JavaScript. An attacker who controls a page hosted on the same site as the Jenkins instance can have the victim's browser retrieve that JavaScript and extract a valid crumb for the victim's session; the attack requires luring the user to the attacker-controlled page. With a valid crumb, the attacker bypasses Jenkins's CSRF protection and can perform actions on Jenkins as the targeted user, with high confidentiality and integrity impact (CVSS 3.1 8.8). Affected releases are Jenkins weekly 2.447 through 2.579, Jenkins LTS 2.452.1 through 2.568.2, and Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (except 2088.2093.vd7c3e58008a_6). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade to a Jenkins weekly later than 2.579 or an LTS later than 2.568.2, or to a Stapler version outside the affected range (2088.2093.vd7c3e58008a_6 already contains the fix). Until patched, limit the exposure by reducing other attacker-influenced applications hosted on the same site/domain as Jenkins, particularly internet-facing controllers. With no known public exploits or KEV listing, patching can follow normal maintenance cadence but should prioritize controllers exposed to untrusted users.