Stored Cross-Site Scripting Vulnerability in Jenkins by CloudBees

CVE-2026-84648

What is CVE-2026-84648?

In affected versions of Jenkins, including 2.579 and earlier, and LTS 2.568.2 and earlier, the system log viewer fails to correctly escape log record metadata. This oversight allows attackers with control over agent processes to exploit the vulnerability, potentially injecting malicious scripts that result in stored cross-site scripting (XSS). Such vulnerabilities pose significant risks as they can lead to unauthorized access and information theft from user sessions.

References