{"id":"CVE-2026-84655","title":"Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and …","summary":"Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-116","CWE-838"],"vendor":"jenkins","product":"jenkins","affected":["jenkins <= 2.568.2","jenkins <= 2.579"],"published":"2026-09-02","updated":"2026-09-15","sourceUpdated":"2026-09-15T18:07:05.090","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84655","references":[{"url":"https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3879","label":"jenkinsci-cert@googlegroups.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84655.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84655"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527585"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84655"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84655"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00313,"epssPercentile":0.24075,"ingestedAt":"2026-09-15T18:41:59.124Z","scores":{"nvd":4.3,"vendor":5.4},"slug":"CVE-2026-84655","body":"## Overview\n\nJenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.\n\n## Affected\n\n- `jenkins <= 2.568.2`\n- `jenkins <= 2.579`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services · no fix planned: OpenShift Developer Tools and Services · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84655.json)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}