Session Fixation Vulnerability in Jenkins by CloudBees

CVE-2026-84652

What is CVE-2026-84652?

In affected versions of Jenkins, there is a flaw that fails to properly rotate user session cookies when users authenticate using the 'remember me' feature. This vulnerability enables attackers, who can host malicious content on the same site as Jenkins, to set a known session cookie in a victim's browser. Once the victim utilizes the 'remember me' cookie for authentication, the attacker gains unauthorized access to Jenkins, impersonating the victim.

References