CVE-2026-84668
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
- Published Sep 2, 2026
- CVSS 8.8 high
- 0.4% chance of exploitation in the next 30 days (EPSS)