CVE-2026-84658
Description
A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows attackers who can submit specific forms to read sensitive script approval configuration due to the improper use of the @DataBoundConstructor annotation on a constructor. This could lead to unauthorized access to configuration details.
Statement
This vulnerability is rated as Moderate impact because exploitation requires an authenticated user with privileges to submit configuration forms, and the flaw only allows unauthorized inspection of script approval data. In Red Hat environments deploying Jenkins, access to job and system configuration forms is typically constrained by role-based access controls, limiting potential exposure. The flaw does not grant privileges to modify scripts or achieve direct remote code execution.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
