Symbolic Name not Mapping to Correct Object Affecting jenkins package, versions *


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.31% (21st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-JENKINS-20198033
  • published29 Sept 2026
  • disclosed2 Sept 2026

Introduced: 2 Sep 2026

CVE-2026-84651  (opens in a new tab)
CWE-386  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:10 jenkins.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jenkins package and not the jenkins package as distributed by RHEL. See How to fix? for RHEL:10 relevant fixed versions and status.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.

CVSS Base Scores

version 3.1