Description

In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:29.620Z",
  "pubdate": "2026-09-02T16:17:29.620Z",
  "executiveSummary": "This vulnerability involves a Cross-Site Request Forgery (CSRF) token disclosure flaw within the Stapler framework used by Jenkins.\nAffected versions include Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, excluding 2088.2093.vd7c3e58008a_6, and corresponding Jenkins core releases 2.447 through 2.579 and LTS 2.452.1 through 2.568.2.\nThe flaw allows an attacker to programmatically extract a valid CSRF crumb (token) belonging to a victim's session.\nBy embedding the crumb as a string literal within dynamically generated JavaScript resources, the application inadvertently exposes sensitive security tokens to unauthorized actors.\nAn attacker who controls a malicious page hosted on the same origin or domain can leverage this disclosure to bypass CSRF protections.\nThis effectively grants the attacker the ability to perform unauthorized state-changing actions on behalf of authenticated users, undermining the security integrity of the Jenkins instance.\nExploitation does not require direct access to the Jenkins UI if the attacker can influence content within the same site environment.",
  "technicalDetails": "The vulnerability originates from an HTTP endpoint within the Stapler framework that serves dynamically generated JavaScript resources. During this process, the application incorrectly embeds the user's CSRF crumb directly into the generated JavaScript code as a string literal.\nIn the context of the Jenkins security architecture, the CSRF crumb is a critical defense-in-depth mechanism designed to ensure that state-changing requests are intentionally initiated by the authenticated user. By exposing this token within a JavaScript scope that is accessible to other resources on the same origin, the application violates the isolation principles required for token security.\nThe attack flow begins when an attacker lures an authenticated Jenkins user to a malicious page or utilizes an existing site integration that shares the same origin as the Jenkins instance. Because the vulnerable JavaScript endpoint is accessible, the attacker's script can fetch or reference the resource where the crumb is exposed.\nSince the crumb is embedded as a literal string within the dynamic JavaScript, an attacker-controlled script can parse this resource to capture the valid CSRF token associated with the victim's current session. Once the crumb is obtained, the attacker can include it in forged HTTP requests, such as POST or PUT operations directed at the Jenkins API or administrative endpoints.\nThe target Jenkins server, upon receiving the forged request, validates the supplied crumb against the victim's session, finds it to be authentic, and proceeds to execute the requested action. This bypasses the protections intended to prevent CSRF attacks.\nThe exposure is prevalent in Stapler versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (excluding 2088.2093.vd7c3e58008a_6). Given that this framework serves as the backbone for request routing and dispatching in Jenkins, the impact extends to a wide range of Jenkins core releases (2.447 through 2.579) and LTS releases (2.452.1 through 2.568.2).\nPost-exploitation impact is severe, as the attacker can perform any action the victim is authorized to execute, potentially leading to unauthorized project configuration changes, plugin installation, or credential exposure."
}