CVE-2026-84652

CVE-2026-84652 is a session fixation flaw (CWE-384) in Jenkins core: the application does not rotate the session identifier when a user is authenticated through the "remember me" cookie. An attacker who is able to serve content on the same site as Jenkins can plant a known session cookie in a victim's browser; when the victim is subsequently authenticated via the "remember me" cookie, Jenkins binds that sign-in to the attacker-chosen session. The attacker can then use the known session identifier to access Jenkins as the victim, obtaining the victim's privileges (high confidentiality and integrity impact, no availability impact per the CVSS vector). All Jenkins weekly releases 2.579 and earlier and LTS releases 2.568.2 and earlier are affected. Exploitation has not been reported: there is no public proof of concept, EPSS is low (0.4%, ~30th percentile), and the issue is not in CISA's KEV catalog.

What to do: Upgrade to a Jenkins weekly release later than 2.579 or an LTS release later than 2.568.2, which rotate the session on "remember me" authentication. Until upgraded, reduce risk by avoiding co-location of attacker-controllable applications on the same site/domain as Jenkins and by having users sign out and back in to invalidate lingering sessions. Verify whether any other applications on your Jenkins domain can set cookies visible to Jenkins when assessing exposure.