Bug 2527582 (CVE-2026-84651)

Summary: CVE-2026-84651 jenkins: Jenkins: Privilege escalation via agent configuration overwrite
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Jenkins. The system's application programming interface (API) and command-line interface (CLI) for managing agent configurations fail to properly validate the target agent. This vulnerability allows an attacker, who already has permissions to configure one agent, to overwrite the configuration of a different agent by manipulating the submitted data. Successful exploitation can lead to privilege escalation, granting the attacker control over the targeted agent's settings and access to sensitive information like its secret keys and environment variables.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-02 15:58:50 UTC 
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.