Jenkins GitLab Plugin CVE-2026-84664

Requires a valid Jenkins user account with at least low-level permissions - Overall/Read is the typical baseline sufficient for Stapler data binding access. The Jenkins GitLab Plugin must be installed and configured with at least one GitLab API token by an administrator; this is the standard operational state for any Jenkins instance integrated with GitLab CI/CD. No non-default plugin configuration is required. Exploitation is partially gated by timing: after overwriting the URL, the attacker must wait for a pipeline, webhook, or scheduled task to trigger a GitLab API call, which in active CI/CD environments occurs automatically and frequently. Accounts already holding Overall/Administer are outside the threat model as they control the configuration legitimately.

The CVSS 5.4 Medium score is driven primarily by PR:L (authenticated low-privilege requirement), which is the principal limiting factor. However, the real-world consequence is disproportionately severe relative to the numeric score: the attacker captures administrator-configured GitLab API tokens that may carry full access to the GitLab instance, making the effective confidentiality impact closer to High than the scored C:L. The attack requires no special plugin configuration beyond the standard operational state (plugin installed and GitLab token configured), is network-accessible with no user interaction (AV:N/UI:N), and is automatable in multi-tenant Jenkins environments where low-privilege accounts are broadly distributed - even a mid-sized municipal IT team in zabrze running a shared Jenkins instance for GitLab CI/CD should treat this as a meaningful credential-theft risk. EPSS data is absent from the provided intelligence; no KEV listing and no public POC have been identified, which moderates urgency, but the low attack complexity and broad account base in typical Jenkins deployments keep operational priority elevated for organizations with GitLab integration configured.

An attacker with a low-privileged Jenkins account crafts a Stapler-bound HTTP POST request targeting the global GitLab Plugin configuration endpoint, substituting the legitimate GitLab server URL with an attacker-controlled HTTPS server. When the next scheduled pipeline build or incoming merge-request webhook triggers a GitLab API call, Jenkins transmits the stored administrator API token as a Bearer credential to the attacker's server, granting full GitLab access. No public POC is known, but the attack requires minimal technical sophistication given Jenkins Stapler's documented and widely understood data binding behavior.