Vulnerability Details CVE-2026-84655
Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 9.0%
CVSS Severity
CVSS v3 Score 4.3