Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to …

Medium CVSS 4.3

CVECVE-2026-84655

First seen2026-09-15 20:30 UTC

Disclosed2026-09-02 16:17 UTC

Last updated2026-09-15 20:30 UTC

Channel statusauto

Summary

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3879 Vendor Advisory

Timeline

2026-09-15 nvd_ingest NVD