Jenkins CVE-2026-84651

Exploitation requires the attacker to hold the Agent/Configure permission on at least one agent in the targeted Jenkins instance - this permission is commonly granted to developers managing their own pipeline infrastructure. No other special configuration is required beyond standard Jenkins agent functionality being enabled. Limiting factors: the attacker must be an authenticated Jenkins user (PR:L, not unauthenticated); the attack is bounded to the same Jenkins controller (S:U, no scope change to external systems directly); and the attacker must know or enumerate the target agent's name. The vulnerability is present in both REST API and CLI agent-update endpoints, so disabling one surface does not eliminate the other.

The vendor-assigned CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) understates real-world impact: the C:L and I:L ratings do not adequately capture that inbound agent secrets and all environment variables are exposed (C:H) and that the victim agent's configuration is fully overwritten (I:H). In practice, agent environment variables in CI/CD pipelines routinely contain cloud provider credentials, container registry tokens, and signing keys - making this a high-severity lateral-movement primitive within Jenkins deployments. The attack requires only low privilege (Agent/Configure on any one agent), no user interaction, and is network-exploitable, making it accessible to any developer or pipeline user who has been granted even minimal agent permissions. No KEV listing confirms active exploitation, and EPSS data was not provided in input; however, the low exploit complexity and the value of CI/CD credentials make opportunistic internal exploitation plausible. Highest risk in multi-tenant Jenkins installations where different teams share a controller with separate agents.

A developer granted Agent/Configure on a low-value sandbox agent crafts an XML document naming a production deployment agent, then submits it via the Jenkins REST API endpoint used to save that production agent's configuration. Jenkins processes the update without verifying agent ownership, overwriting the production agent's settings and returning or storing its inbound secret, which the attacker harvests to impersonate the production agent and extract all of its environment variables - including cloud deployment credentials.