CVE-2026-84655

Jenkins versions 2.579 and earlier and LTS 2.568.2 and earlier fail to escape map keys when serializing objects as JSON and Python through its REST API. Attackers who can control map property names can inject arbitrary fields into JSON and Python API responses. CISA ADP assesses exploitation as n...

EUVD-2026-70121

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

Injection vulnerability in REST API

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API. This allows attackers able to control map property names to inject arbitrary fields into JSON and Python API responses. Jenkins 2.580, LTS 2.568.3 escapes...