EUVD-2026-70115
GHSA-hxvq-fvg2-gh6m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H reflects the non-trivial prerequisite of controlling a same-origin page on the Jenkins controller; all other metrics align with the official vector.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
Articles & Coverage 2
AnalysisAI
CSRF token leakage in Jenkins allows an attacker who controls any same-origin page on the Jenkins controller to silently steal a valid CSRF crumb from an authenticated user's session and forge privileged requests on their behalf. The vulnerability spans Jenkins 2.447-2.579 (weekly) and LTS 2.452.1-2.568.2 via the bundled Stapler web framework, which embeds the session crumb as a plaintext string literal inside dynamically generated JavaScript responses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attack requires two simultaneous conditions: (1) the attacker must control a page served from the exact same origin (protocol, hostname, and port) as the Jenkins controller - achievable via stored XSS in any insufficiently escaped user-controlled field (job names, descriptions, build parameters, plugin UI), via a Jenkins-hosted user page, or via any other same-origin content injection vector; and (2) an authenticated Jenkins user - ideally one with administrative privileges - must visit the attacker-controlled page while holding an active session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) likely overstates exploitation ease because the attack carries a non-trivial prerequisite: the attacker must already control a page served from the same origin as the Jenkins controller. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Jenkins 2.580 (weekly) or Jenkins LTS 2.568.3, both confirmed as patched releases per EUVD data and the official Jenkins security advisory (SECURITY-3878) at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3878. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Jenkins access logs for suspicious administrative activity and review any recently deployed content or plugins; restrict Jenkins web UI access to trusted corporate networks only if operationally feasible, and alert all Jenkins administrators and pipeline operators of the vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today