High [CVE-2026-84649] Cross-site request forgery token disclosure allows session hijacking
This high-severity Red Hat Linux advisory covers CVE-2026-84649 affecting OpenShift Developer Tools and Services.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf.
A flaw was found in Stapler, a web framework used by Jenkins. Consequently, the attacker can perform unauthorized actions on behalf of the user, leading to session hijacking.
This Important vulnerability in Stapler, as used in Jenkins, allows an attacker to perform session hijacking. This risk is elevated when the Resource Root URL is configured on the same domain as the Jenkins URL.
Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-201.
Affected Red Hat products: OpenShift Developer Tools and Services. Red Hat does not currently list a fixing RHSA for this CVE.
- 2.447
- 2.579
- 2.452.1
- 2.568.2
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- To mitigate this issue, administrators should disable the Resource Root URL feature in Jenkins or configure it to use a different domain than the main Jenkins instance. This prevents an attacker from loading dynamically generated JavaScript resources containing the CSRF token from a co-hosted page.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.