Jenkins CVE-2026-84656

The attacker must possess a valid Jenkins account with Item/Read permission on at least one job anywhere in the Jenkins instance - this is the only prerequisite, and any job (including low-sensitivity ones) satisfies the condition. No special configuration, plugin, or deployment mode is required beyond a standard Jenkins installation with multiple jobs or teams. Exploitation is bounded to read-only access of parameter names and values; the attacker cannot execute builds, modify jobs, or escalate further through this vulnerability alone. The risk is most acute in shared/multi-tenant Jenkins instances where different teams or sensitivity levels coexist on the same controller.

The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a moderate-priority information-disclosure flaw: network-accessible, low complexity, but requiring a valid low-privilege account. Real-world risk is materially higher than the raw score implies in multi-tenant Jenkins deployments - build parameters frequently contain plaintext API keys, deployment credentials, or environment secrets, meaning C:L understates the actual sensitivity of what may be leaked in practice. EPSS data is not present in the provided intelligence, and no KEV listing or public exploit has been identified, suggesting opportunistic exploitation is not yet documented. The 'Authentication Bypass' tag is a mislabel; this is an authorization (not authentication) control gap - the attacker is fully authenticated. Even a mid-sized municipal IT team in mielec sharing a Jenkins instance across departments should treat this as a patch-cycle priority rather than a back-burner item, given the sensitivity of what build parameters typically carry.

An attacker with a low-privilege Jenkins account - perhaps a contractor account with Item/Read on a single non-sensitive pipeline - sends a crafted API request targeting a restricted job belonging to another team. The missing permission check causes Jenkins to return that job's build parameter names and values, potentially exposing API tokens, database passwords, or cloud credentials stored as build parameters. No public exploit code has been identified, but the attack is straightforward for any user familiar with the Jenkins REST API.