CVE-2026-84652
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie. This allows attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
Risk Assessment
An attacker can hijack a user's session and gain unauthorized access to Jenkins, potentially leading to data theft or further attacks.
Recommendation
Update Jenkins to a version newer than 2.579 or LTS newer than 2.568.2 as soon as a fix is available.
Other vulnerabilities in Jenkins
See all- CVE-2016-3726High
Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks.
- CVE-2016-0792High
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
- CVE-2015-7538High
Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors.
- CVE-2015-7537High
CVE-2015-7537 is a CSRF vulnerability in Jenkins before version 1.640 and LTS before version 1.625.2 that allows remote attackers to hijack the authentication of administrators via unspecified vectors related to the HTTP GET method.
- CVE-2015-5325High
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave.
- CVE-2014-2063High
Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
- CVE-2014-3666High
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.
- CVE-2026-70426Critical
In Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in Remoting deserialization. This allows agents, code on agents, and attackers with Agent/Connect permission to bypass the filter for classes on the Jenkins core classpath.
- CVE-2026-53435High
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, an attacker can deserialize arbitrary types from Jenkins core or plugins via a crafted `config.xml` submission. This allows handling HTTP requests, impersonating any user, executing arbitrary code via the Script Console, or reading arbitrary files from the Jenkins controller.
- CVE-2024-23897CriticalActively exploited
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Original NVD description (English source)
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim authenticates via the "remember me" cookie, grants the attacker access to Jenkins as that user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS