CVE-2026-84664

MediumCVSS 5.4

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.

Risk Assessment

An attacker can take control of the GitLab connection, potentially leading to leakage of sensitive data, manipulation of repositories, or other unauthorized actions in the GitLab environment.

Recommendation

Update the GitLab plugin to a version that fixes this vulnerability. Restrict access to global configuration and monitor changes to connection settings.

Other vulnerabilities in Jenkins GitLab Plugin

CVE-2026-92133Medium
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS