---
id: CVE-2026-84655
title: >-
  Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys
  when serializing objects as JSON and Python through its REST API, allowing
  attackers able to control map property names to inject arbitrary fields into
  JSON and …
summary: >-
  Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys
  when serializing objects as JSON and Python through its REST API, allowing
  attackers able to control map property names to inject arbitrary fields into
  JSON and …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-116
vendor: jenkins
product: jenkins
affected:
  - jenkins <= 2.568.2
  - jenkins <= 2.579
published: '2026-09-02'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T18:07:05.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84655'
references:
  - url: 'https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3879'
    label: jenkinsci-cert@googlegroups.com
tags:
  - nvd
epss: 0.00313
epssPercentile: 0.2174
ingestedAt: '2026-09-15T18:41:59.124Z'
---

## Overview

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.

## Affected

- `jenkins <= 2.568.2`
- `jenkins <= 2.579`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.