VULNERABILITY INTELLIGENCE

CVE-2026-84655

CVSS score4.3 MEDIUM
EPSS probability0.48%
CISA KEVNot currently listed
Published2026-09-02
Last modified2026-09-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-116

Primary references