Jenkins Stapler data binding type confusion enables config object injection, RCE, and stored XSS - Upwind | Cloud & AI Security for the Realtime Era

Security Feed

See the latest insights and analysis from our MDR team.

CVE-2026-84645, CVE-2026-84647, CVE-2026-84648

By Roy Kalfon |

6 September 2026

Jenkins Stapler data binding type confusion enables config object injection, RCE, and stored XSS

Jenkins `