BIT-jenkins-2026-84650

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2026-84650.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-jenkins-2026-84650

Aliases

CVE-2026-84650

Published

2026-09-08T08:16:26Z

Modified

2026-09-12T09:15:03Z

Summary

[none]

Details

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:maven:*:*"
    ],
    "severity":  "High"
}

References

Affected packages

Bitnami / jenkins

Package

Name: jenkins
Purl: pkg:bitnami/jenkins

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.568.3

Introduced

2.569.0

Fixed

2.580.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2026-84650.json"