What is GHSA-6q2p-xwgj-7xw4?

GHSA-6q2p-xwgj-7xw4 is a security advisory published by GitHub Security Advisories with High severity. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from...

Which CVE IDs does GHSA-6q2p-xwgj-7xw4 cover?

GHSA-6q2p-xwgj-7xw4 covers the following CVE IDs: CVE-2026-84650. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6q2p-xwgj-7xw4?

GHSA-6q2p-xwgj-7xw4 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-6q2p-xwgj-7xw4HighCVSS 8.8

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-84650 →

📋 Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84650
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4032
https://github.com/advisories/GHSA-6q2p-xwgj-7xw4