The Jenkins Patch List Is 33 CVEs Long! Now, where do you start?
Jenkins has released one of those security advisories that cannot be skimmed. The 2 September bulletin contains 33 CVEs across Jenkins core and widely used plugins. Several issues can expose controller secrets or code execution, and one high-severity core flaw can give a low-privileged user access to the Script Console.
Jenkins core users should move to 2.580 or LTS 2.568.3. Plugin fixes vary, and one affected plugin still has no fix. Jenkins reported no known malicious exploitation or public proof of concept for the bulletin at publication.
The shortest route to controller compromise
CVE-2026-84645 is the priority. Unsafe deserialisation can let a user with Overall/Read reach the Script Console, which effectively means arbitrary code execution on the controller. Three other core issues, CVE-2026-84646, CVE-2026-84647 and CVE-2026-84654, let a low-privileged user create internal objects, instantiate configuration types or modify public static configuration fields.
Jenkins installations should treat Overall/Read as a meaningful security boundary. The bulletin repeatedly shows how an account that appears read-only can influence controller state or obtain data that was expected to remain isolated.
Every CVE in the bulletin
| CVE | Impact and prerequisite | Remediation |
|---|---|---|
| CVE-2026-84645 | Unsafe deserialisation, Overall/Read, Script Console and controller RCE | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84646 | Creates arbitrary user objects with Overall/Read | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84647 | Instantiates arbitrary configuration types with Overall/Read | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84648 | Stored XSS through system logs when an attacker controls an agent | Update core; CSP reduces exposure |
| CVE-2026-84649 | CSRF crumbs accepted cross-origin on same-site domains | Update; disabling Resource Root or using a different domain is a workaround |
| CVE-2026-84650 | Transient fields can overwrite configuration values | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84651 | Overwrite another agent and steal its inbound secret or environment | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84652 | Remember-me session fixation | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84653 | Missing permission check in Appearance configuration | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84654 | Changes public static configuration fields | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84655 | Map-key injection through REST JSON or Python data | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84656 | Reads build parameters from other jobs | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84657 | Cancels builds belonging to other users | Jenkins 2.580 or LTS 2.568.3 |
| CVE-2026-84658 | Reads Script Security approval configuration | Script Security 1415 or later |
| CVE-2026-84659 | Disables forced Groovy sandboxing | Script Security 1415 or later |
| CVE-2026-84660 | Cancels downstream builds | Pipeline Build Step 601 or later |
| CVE-2026-84661 | Cancels builds through waitForBuild | Pipeline Build Step 601 or later |
| CVE-2026-84662 | LDAP server-side request forgery | LDAP 825.v2e9c2a_69d343 or later |
| CVE-2026-84663 | CSRF can delete shared-library caches | Pipeline Groovy 805 or later |
| CVE-2026-84664 | GitLab SSRF using configured administrator API tokens | GitLab Branch Source 1.9.182144.vc0c3c4e15c28 or later |
| CVE-2026-84665 | Stored XSS in SonarQube Scanner | SonarQube Scanner 2.19 or later |
| CVE-2026-84666 | Redirect-based storage issue in Job Config History | Job Config History 1380 or later |
| CVE-2026-84667 | ThinBackup path manipulation can include arbitrary controller files | ThinBackup 2.1.5 or later |
| CVE-2026-84668 | SAML metadata overwrite can enable authentication as any user | SAML 4.623 or later |
| CVE-2026-84669 | Allure path traversal can read controller files | Allure 2.36 or later |
| CVE-2026-84670 | Performance plugin unsafe deserialisation allows controller RCE | Performance 1017 or later |
| CVE-2026-84671 | File Parameter path traversal enables arbitrary write and possible RCE | File Parameter 433 or later |
| CVE-2026-84672 | Entra ID privilege escalation through group display-name collision | Microsoft Entra ID 711 or later |
| CVE-2026-84673 | Custom Header stored XSS through SVG content | Custom Header 330 or later |
| CVE-2026-84674 | XebiaLabs credential ID enumeration | XebiaLabs 26.3 or later |
| CVE-2026-84675 | TICS command injection on agents through environment variables | TICS 2026.1.0 or later |
| CVE-2026-84676 | Parameterized Remote Trigger stores tokens in plaintext | No fix available; remove or isolate the plugin |
| CVE-2026-84677 | Stored XSS in update-center2 | update-center2 3.18.4 or later |
What to do first
Patch Jenkins core, then inventory every plugin against the fixed versions. Restrict Overall/Read, remove unused plugins and rotate credentials if an affected component could expose secrets. Administrators using Parameterized Remote Trigger should treat stored tokens as exposed until the plugin is removed or a fix arrives.
This bulletin is not one vulnerability. It is a map of how a CI/CD controller can become a bridge between source code, credentials, build agents and production systems. The Script Console flaw is the fastest reason to act, but the cumulative risk is the real story.
