CVE-2026-84668

HighCVSS 8.8

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Jenkins SAML Plugin version 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

Risk Assessment

Risk of complete takeover of Jenkins user accounts, including administrators, by replacing SAML metadata.

Recommendation

Update the Jenkins SAML Plugin to a version newer than 4.618.v441a_27fa_46d2 that includes the fix.

Other vulnerabilities in Jenkins SAML Plugin

CVE-2025-64131High
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

Original NVD description (English source)

Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS