CVE-2026-84655 PUBLISHED

Assigner: jenkins
Reserved: 01.09.2026 Published: 02.09.2026 Updated: 02.09.2026

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

Product Status

Vendor Jenkins Project
Product Jenkins
Versions Default: affected
  • unaffected from 2.580 to * (excl.)
  • unaffected from 2.568.3 to 2.568.* (excl.)

References