Jenkins 2.580 and LTS 2.568.3: The September 2026 Core Security Fixes

On 2 September 2026 the Jenkins project published a security advisory covering Jenkins core and 18 other deliverables (17 plugins plus the update-center2 tool), with 33 CVE IDs in total. The core fixes ship in Jenkins weekly 2.580 and LTS 2.568.3. The headline issue, CVE-2026-84645, is a deserialization flaw that the advisory says can give attackers access to an improperly protected Script Console, which means remote code execution on the controller.

Most of the core issues were reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Several of them come from the same root: how Jenkins and its Stapler web framework turn submitted XML and form data into Java objects.

What's affected

Jenkins core 2.579 and earlier, and LTS 2.568.2 and earlier. The core issues worth knowing by name:

• CVE-2026-84645 (High): objects of types that normally live in their own top level config files (agents, items, builds) could appear as nested values inside a user submitted config.xml and then handle HTTP requests via Stapler. A crafted combination leads to Script Console access.
• CVE-2026-84647 (High): Stapler form binding did not restrict instantiated types to ones compatible with the expected field, so users with only Overall/Read could instantiate unintended configuration types.
• CVE-2026-84649 (High): dynamically generated JavaScript embedded the user's CSRF crumb as a string literal, so a page on a sibling subdomain could load it as a script and steal the crumb. This affects Jenkins 2.447 through 2.579 and LTS 2.452.1 through 2.568.2.
• CVE-2026-84650 (High): transient fields could still be set during deserialization by anyone able to submit configuration.
• CVE-2026-84652 (High): session fixation through the "Keep me signed in" cookie, exploitable from a sibling subdomain.
• CVE-2026-84648 (High): stored XSS in the system log viewer, exploitable by attackers who control agent processes.
• CVE-2026-84651 (Medium): a user with Agent/Configure on one agent could overwrite a different agent's configuration and obtain its inbound secret.

Plugins fixed in the same advisory include Script Security 1415.v9a_f9b_3a_c253d, LDAP 825.v2fca_37dd5b_cb_, SAML 4.623.v7875d61cd9f5, SonarQube Scanner 2.19.0, Pipeline: Build Step 601.v6d4c6d1a_9dc7, Pipeline: Groovy Libraries 805.va_fc79344957d and TICS 2026.1.0. Parameterized Remote Trigger had no fix at publication: version 3.2.2 and earlier stores tokens unencrypted in job config.xml.

How to check if you're exposed

Jenkins reports its version in a response header, so you can sweep every controller you know about:

for host in jenkins.example.org ci-legacy.example.org; do
  printf '%s ' "$host"
  curl -skI "https://$host/login" | grep -i '^x-jenkins:'
done

Anything at 2.579 or lower on weekly, or 2.568.2 or lower on LTS, needs the update. For plugins, run this in the Script Console on each controller (as an administrator) to dump installed versions and compare against the advisory's fixed versions:

Jenkins.instance.pluginManager.plugins
  .sort { it.shortName }
  .each { println "${it.shortName}:${it.version}" }

Two configuration checks matter for CVE-2026-84649 and CVE-2026-84652. Open Manage Jenkins, System, and look at the Resource Root URL. If it sits on the same site as Jenkins (for example jenkins-assets.example.org next to jenkins.example.org), the CSRF crumb leak is easier to exploit. Also list what else you host on sibling subdomains under the same parent domain.

What to do now

1. Upgrade controllers to Jenkins 2.580 (weekly) or 2.568.3 (LTS). Container users should pull the matching jenkins/jenkins tag and redeploy rather than patch in place.
2. Update the plugins named in the advisory in the same window, especially Script Security, LDAP, SAML, Pipeline: Build Step and Pipeline: Groovy Libraries.
3. If you cannot upgrade today, follow the advisory's interim step for the crumb leak: disable the Resource Root URL feature, or move it to a different registrable domain than Jenkins (for example jenkins-assets.example.com for a Jenkins at jenkins.example.org).
4. Remove or replace Parameterized Remote Trigger where you can, since there is no fix, and rotate any tokens it stored in job configuration.
5. Rotate inbound agent secrets if users with Agent/Configure permission on a single agent are not fully trusted, given CVE-2026-84651.
6. Enforce Content Security Policy. The advisory notes that on Jenkins 2.539 and newer, and LTS 2.541.1 and newer, enforcing CSP mitigates the log viewer XSS.

Why it matters

The common thread is object binding. Jenkins accepts XML and form data from users with fairly modest permissions, and turns it into live Java objects. Each of these CVEs is a place where the type system or a permission check did not hold the line, and the fix in 2.580 tightens the rules in Jenkins and Stapler rather than patching a single endpoint.

The same site findings are a quieter lesson. Two of the High issues depend on an attacker controlling content on a sibling subdomain. If your Jenkins lives next to wikis, preview environments or user content under one parent domain, your CI is only as isolated as the least trusted thing on that domain.

Try it yourself

Pick one controller and produce a plugin inventory with the Groovy snippet above. Count how many plugins are more than one advisory behind, then decide which ones you actually use. Unused plugins are attack surface you can delete today.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Jenkins Security Advisory 2026-09-02
• Jenkins security advisories index
• Canadian Centre for Cyber Security: Jenkins security advisory AV26-877