Description

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify public static fields of the configuration objects those forms are bound to, resulting in changes that apply globally to the Jenkins instance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T16:17:30.080Z",
  "pubdate": "2026-09-02T16:17:30.080Z",
  "executiveSummary": "A critical vulnerability exists in the Stapler framework, specifically impacting Jenkins instances due to improper form data binding. The vulnerability allows an attacker to modify public static fields of bound configuration objects.\nThis flaw is classified as a configuration injection vulnerability. By exploiting the binding process, an authenticated attacker with access to configuration forms can alter the application's global state by manipulating static class members.\nThe vulnerability affects Stapler versions 2107.v8dfcb_e8ed317 and earlier, excluding version 2088.2093.vd7c3e58008a_6. It impacts Jenkins 2.579 and earlier, as well as Jenkins LTS 2.568.2 and earlier.\nThe primary risk implication is a compromise of the Jenkins instance's global configuration, potentially leading to unauthorized modifications of security settings, service behaviors, or internal application logic. Successful exploitation requires an attacker to possess the necessary permissions to submit configuration forms within the Jenkins UI.",
  "technicalDetails": "The root cause of this vulnerability lies in the Stapler framework's data-binding mechanism, which is responsible for mapping HTTP request parameters from configuration forms to the fields of Java objects. During this process, the framework fails to adequately restrict the scope of accessible fields, inadvertently exposing public static fields to user-controlled input.\nIn Java, static fields belong to the class itself rather than an instance of the class. When the data binding process traverses the object structure, it does not distinguish between instance variables and static variables, allowing the reflection-based binder to overwrite these shared fields.\nThe exploitation flow proceeds as follows: First, an attacker identifies a configuration form bound to a specific class containing public static fields. Second, the attacker constructs a malicious POST request containing parameters that target these fields via the form data binding interface. Third, the attacker submits this form to the Jenkins instance. Because the attacker possesses the privileges required to interact with the configuration form, the server accepts the input. Finally, the Stapler binder processes the request and maps the attacker-supplied values directly onto the class's public static fields.\nThe impact of this injection is systemic. Because static fields maintain their value for the lifetime of the application, changes are not isolated to the current user session or the specific object instance; they persist globally across the Jenkins controller. This effectively allows an attacker to change the behavior of the application by injecting arbitrary values into static configuration hooks or state variables.\nThe vulnerability is limited to environments where the attacker has sufficient privileges to access and submit form data that triggers the vulnerable binding logic. While not a direct remote code execution exploit in its basic form, the ability to modify global application state through configuration binding can often be chained with other gadgets or logic flaws to achieve full system compromise, depending on the purpose of the targeted static fields within the Jenkins ecosystem.\nThe affected components are the Jenkins configuration binding routines that rely on Stapler for HTTP-to-POJO mapping. The vulnerability persists in all versions specified until the patched versions are implemented, ensuring that static member access control is enforced during the data binding sequence."
}