The flaw in Stapler’s form data binding permits an attacker who can submit configuration forms to alter public static fields on Jenkins configuration objects. The static fields persist across all job and global configurations, so a single compromised form submission can globally change settings that affect the entire Jenkins instance, as noted by the CWE-472 classification. This does not provide direct code execution but allows an attacker to change system behavior that may be leveraged for further attacks.

Jenkins Project Jenkins version 2.579 and earlier, and LTS releases 2.568.2 and earlier are impacted. Any Jenkins installation using Stapler 2107.v8dfcb_e8ed317 or earlier, except those containing 2088.2093.vd7c3e58008a_6, is vulnerable.

The vulnerability carries a CVSS score of 5.4, indicating a moderate risk. EPSS data is unavailable, and it is not currently listed in the CISA KEV catalog. Attackers would need legitimate access to Jenkins’s web interface with permission to submit configuration forms, which may be achieved remotely if authentication is weak or misconfigured. The damage is limited to configuration changes rather than arbitrary code execution, but the impact can be significant if critical settings are altered.