BIT-jenkins-2026-84645

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2026-84645.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-jenkins-2026-84645
Aliases
Published
2026-09-08T08:16:21Z
Modified
2026-09-12T09:15:03Z
Summary
[none]
Details

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field values in user-submitted config.xml documents and subsequently handle HTTP requests via Stapler, resulting in remote code execution.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:maven:*:*"
    ],
    "severity":  "High"
}
References

Affected packages

Bitnami / jenkins

Package

Name
jenkins
Purl
pkg:bitnami/jenkins

Severity

  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.568.3
Introduced
2.569.0
Fixed
2.580.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2026-84645.json"