Backup Configuration Overwrite in Jenkins ThinBackup Plugin by CloudBees
CVE-2026-84667

7.1HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins Thinbackup Plugin
Vendor
CVE Published:
2 September 2026

What is CVE-2026-84667?

The Jenkins ThinBackup Plugin versions up to 2.1.4 contains a vulnerability that allows attackers to manipulate the plugin's backup configuration settings through Stapler data binding. This flaw enables unauthorized users to reroute backup outputs to a directory of their choice, potentially accessing and including arbitrary files from the Jenkins controller's file system. The exposed attack vector poses a serious risk to data integrity and security for Jenkins installations utilizing this plugin.

Affected Version(s)

Jenkins ThinBackup Plugin 0 <= 2.1.4

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECU...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.