CVE-2026-84650

Jenkins controllers through weekly 2.579 and LTS 2.568.2 fail to exclude Java transient fields from deserialization when processing configuration updates (an insecure deserialization flaw, CWE-502), so client-supplied values for transient fields are deserialized even though those fields were marked transient. An attacker needs only limited privileges on the controller—specifically the ability to submit configuration updates, such as job or node configuration—and can craft such an update to inject attacker-controlled values into transient fields. The actual impact depends on how those transient fields are used by the affected code and plugins, but the assessed CVSS 3.1 score of 8.8 (high) with high confidentiality, integrity, and availability impact reflects the worst-case outcome. Anyone running a Jenkins controller on weekly 2.579 or earlier or LTS 2.568.2 or earlier is affected. There is no evidence of exploitation so far: no known public proof-of-concept, not listed in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%.

What to do: Upgrade the Jenkins controller beyond weekly 2.579 and beyond LTS 2.568.2 as soon as patched releases are available. As an interim mitigation, restrict which users can submit configuration updates (e.g., limit Configure permissions on jobs and nodes) and avoid exposing controllers to the internet with permissive authentication. Note that real-world impact depends on how transient fields are used by your installed plugins, so prioritize updates on controllers running plugins that process attacker-influenced data in such fields.