Stapler, a component of Jenkins, improperly embeds the CSRF token (crumb) as a string literal in dynamically generated JavaScript resources. This flaw allows an attacker who can host a malicious page on the same domain as Jenkins to read the token and subsequently perform any actions that the authenticated user is authorized to perform, effectively hijacking the user's session. The vulnerability is a cross‑site request forgery (CSRF) flaw, identified as CWE‑352, and also violates access control mechanisms, classified as CWE‑201, and can lead to arbitrary configuration changes, the execution of builds, or other privileged operations on the target Jenkins instance.

The issue impacts the Stapler component in Jenkins versions 2.447 through 2.579 inclusive and LTS releases 2.452.1 through 2.568.2 inclusive, excluding the specific release 2088.2093.vd7c3e58008a_6. It applies to Stapler releases starting with 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, both inclusive, except for 2088.2093.vd7c3e58008a_6. All affected deployments are produced by the Jenkins Project.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS data is < 1%, so the likelihood of active exploitation remains low, and the vulnerability is not listed in the CISA KEV catalog. The flaw is a cross‑site request forgery (CWE‑352) that also violates access control checks (CWE‑201), allowing a web‑based attacker to host a malicious page on the same domain as Jenkins, read the exposed token, and then perform privileged actions on behalf of the victim. Although the exploitability exploits a CSRF weakness, the concurrent access‑control violation amplifies potential impact, especially if the authenticated user has broad permissions.