CVE-2026-84664

—

CVSS 3.1

5.4 medium

EPSS

<1%p1

Published

Sep 2, 2026 (13d ago)

Modified

Sep 3, 2026

Description

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.

Weakness: CWE-471, CWE-494
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.