---
id: CVE-2026-84655
title: >-
  Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys
  when serializing objects as JSON and Python through its REST API, allowing
  attackers able to control map property names to inject arbitrary fields into
  JSON and …
summary: >-
  Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys
  when serializing objects as JSON and Python through its REST API, allowing
  attackers able to control map property names to inject arbitrary fields into
  JSON and …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-116
  - CWE-838
vendor: jenkins
product: jenkins
affected:
  - jenkins <= 2.568.2
  - jenkins <= 2.579
published: '2026-09-02'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T18:07:05.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84655'
references:
  - url: 'https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3879'
    label: jenkinsci-cert@googlegroups.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84655.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84655'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527585'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84655'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84655'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00313
epssPercentile: 0.24075
ingestedAt: '2026-09-15T18:41:59.124Z'
scores:
  nvd: 4.3
  vendor: 5.4
---

## Overview

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

## Affected

- `jenkins <= 2.568.2`
- `jenkins <= 2.579`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services · no fix planned: OpenShift Developer Tools and Services · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84655.json)