CVE-2026-84664
Medium · 5.4CVSS
5.4
EPSS
0.1%
Published
Sep 2, 2026
CISA due date
—
The record
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. CWE-471
- CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor… CWE-471
- CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function. CWE-471
- CVE-2026-54267 Angular is a development platform for building mobile and desktop web applications using… CWE-471
- GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook… CWE-471
- GHSA-rgjc-h3x7-9mwg Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CWE-471
- CVE-2026-44798 Nautobot is a Network Source of Truth and Network Automation Platform. CWE-471
- CVE-2026-8492 Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal… CWE-471