Jenkins releases 2.579 and earlier, including LTS 2.568.2 and earlier, do not escape map keys during object serialization to JSON. Attackers who can control map property names are able to inject arbitrary fields into the JSON and Python responses generated by the REST API. This flaw, classified as CWE-116, allows an attacker to modify the structure of API responses, potentially misleading clients or providing a vector for further exploitation such as information disclosure or privilege escalation.

The affected product is Jenkins by the Jenkins Project, specifically all releases up to and including version 2.579 and LTS 2.568.2. Any instance of Jenkins running one of these versions with a reachable REST API is vulnerable.

The CVSS score of 4.3 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted JSON payloads through the REST API, requiring the ability to influence map keys, such as through authenticated API calls or user-supplied input to Jenkins plugins. While no public exploits are known, the flaw permits arbitrary field injection, warranting timely remediation.