CVE-2026-84656 - jenkins: Jenkins: Information disclosure via missing permission check

Back Back to CVE browser

MEDIUM

jenkins: Jenkins: Information disclosure via missing permission check

Published Sep 2, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.30%

Description

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

Affected products

Product	Package	State	Advisory
OpenShift Developer Tools and Services	jenkins	Fix deferred	n/a

Remediation

Red Hat statement

A flaw was found in Jenkins. Information disclosure is possible due to a missing permission check, allowing authenticated users with Item/Read permission to read build parameter names and values from jobs they don't have access to. This issue affects Jenkins versions up to 2.579 (weekly) and up to 2.568.2 (LTS).

Red Hat mitigation

Update to Jenkins 2.580 (weekly) or Jenkins LTS 2.568.3 or later.

Weaknesses (2)

CWE-425

CWE-862

Missing Authorization

References (6)

https://access.redhat.com/security/cve/CVE-2026-84656
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527598
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70122
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84656
https://www.cve.org/CVERecord?id=CVE-2026-84656
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4006
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-84656		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527598		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70122		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84656
https://www.cve.org/CVERecord?id=CVE-2026-84656
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4006		vendor-advisoryVendor Advisory