CVE-2026-84647
Description
A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enabling the attacker to instantiate types for which the field was not intended. This could lead to unauthorized manipulation of system configurations.
Statement
Red Hat rates this Important, CVSS 8.5, against CISA's 8.8. Both agree on attack vector, complexity, and the Overall/Read requirement; they differ on impact.
Stapler's form binding normally restricts which object types a submitted form can instantiate to match the target field. This flaw removes that restriction, so an attacker can force creation of unintended configuration objects. That is unauthorized modification of config state, an integrity problem. It is not a confidentiality or availability problem: instantiating an object doesn't return its contents to the attacker, and nothing in the advisory shows a crash or resource exhaustion path. Red Hat scores confidentiality Low and availability None accordingly. CISA's C:H/A:H assumes a worst case gadget chain outcome; Red Hat scores to what the advisory actually demonstrates.
Exploitation needs an account that already holds Overall/Read on the Jenkins instance in the ocp-tools-4 images. That permission isn't granted to anonymous users by default, and these deployments typically run inside an OpenShift project behind cluster auth, not exposed pre-auth. An attacker needs a foothold first.
Mitigation
Restrict Overall/Read to the minimum set of trusted users; don't grant it to broad or anonymous groups. That permission is the flaw's own precondition for exploitation, so removing it from untrusted accounts closes this specific path. No other workaround is documented; the fix requires an updated Stapler.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
