What is GHSA-8wrx-j32g-7fcf?

GHSA-8wrx-j32g-7fcf is a security advisory published by GitHub Security Advisories with Medium severity. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field...

Which CVE IDs does GHSA-8wrx-j32g-7fcf cover?

GHSA-8wrx-j32g-7fcf covers the following CVE IDs: CVE-2026-84646. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8wrx-j32g-7fcf?

GHSA-8wrx-j32g-7fcf has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-8wrx-j32g-7fcfMediumCVSS 4.3

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-84646 →

📋 Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84646
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3908
https://github.com/advisories/GHSA-8wrx-j32g-7fcf