CVE-2026-84645

Jenkins versions 2.579 and earlier (LTS 2.568.2 and earlier ) are vulnerable to a deserialization flaw. The root cause is that objects marked as PersistenceRoot types can be deserialized as nested field values in user-submitted config.xml documents. This allows an attacker with Item/Configure per...