CVE-2026-84649
Description
A flaw was found in Stapler, a web framework used by Jenkins. An HTTP endpoint that serves dynamically generated JavaScript resources inadvertently embeds a user's cross-site request forgery (CSRF) token, also known as a crumb, as plain text. This allows a remote attacker, who controls a web page on the same site as Jenkins, to obtain a valid crumb for a targeted user's session. Consequently, the attacker can perform unauthorized actions on behalf of the user, leading to session hijacking.
Statement
This Important vulnerability in Stapler, as used in Jenkins, allows an attacker to perform session hijacking. By controlling a web page on the same site as Jenkins, an attacker can hijack a user's token through cross-site request forgery (CSRF), enabling unauthorized actions. This risk is elevated when the Resource Root URL is configured on the same domain as the Jenkins URL.
Mitigation
To mitigate this issue, administrators should disable the Resource Root URL feature in Jenkins or configure it to use a different domain than the main Jenkins instance. This prevents an attacker from loading dynamically generated JavaScript resources containing the CSRF token from a co-hosted page.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
