CVE-2026-84655 — Jenkins Project / Jenkins

CVE-2026-84655

Jenkins Project / Jenkins PUBLISHED

Description (CNA)

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins	unaffected 2.580 before ; unaffected 2.568.3 before 2.568.

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3879

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.