CVEvulnerability

CVE-2026-84655

4.3 MEDIUM Published 2026-09-02 Modified 2026-09-15 Official page ↗
Status
Analyzed
Published
2026-09-02
Last modified
2026-09-15
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-116

Description

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

Affected configurations

• jenkins jenkins (<= 2.568.2) • jenkins jenkins (<= 2.579)

Related

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References