Is CVE-2026-84664 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-84664

Description

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.