{
  "schema_version": 1,
  "ticket_id": "CVE-2026-84645",
  "equivalent": true,
  "confidence": 1.0,
  "parent_trigger": {
    "carrier": "hudson.triggers.SCMTrigger$BuildAction#run",
    "route": "/job/carrier/pollingLog/run/project/parent/scriptText",
    "graph": "SCMTrigger.BuildAction -> FreeStyleBuild -> FreeStyleProject -> Hudson"
  },
  "alternate_trigger": {
    "carrier": "hudson.tasks.Fingerprinter$FingerprintAction#build",
    "route": "/job/carrier/fingerprints/run/project/parent/scriptText",
    "graph": "Fingerprinter.FingerprintAction -> FreeStyleBuild -> FreeStyleProject -> Hudson"
  },
  "shared_trust_boundary": "A low-privilege authenticated HTTP user with Overall/Read, Item/Read, and Item/Configure submits job configuration XML and then invokes a Stapler route; direct /scriptText is HTTP 403.",
  "shared_source": "Attacker-controlled nested PersistenceRoot values accepted by Items.XSTREAM2 on Jenkins 2.579.",
  "shared_sink": "Stapler reflective traversal to forged hudson.model.Hudson#doScriptText with AuthorizationStrategy$Unsecured.",
  "shared_impact": "Arbitrary Groovy and operating-system command execution in the Jenkins controller process.",
  "material_difference": "The alternate uses a different core action class, different transient Run field (build rather than run), different URL name (fingerprints rather than pollingLog), and different getter implementation before converging at Run#getProject.",
  "fixed_behavior": "Jenkins 2.580 removes FingerprintAction#build from the persisted graph, the alternate route returns HTTP 404, and no marker is created.",
  "evidence": {
    "alternate_rce": "bundle/logs/vuln_variant/proof/vulnerable.fingerprint.route.response.body",
    "alternate_observation": "bundle/logs/vuln_variant/proof/vulnerable.fingerprint.observation.json",
    "fixed_observation": "bundle/logs/vuln_variant/proof/fixed.fingerprint.observation.json",
    "fixed_graph": "bundle/logs/vuln_variant/proof/fixed.fingerprint.config.after.xml"
  }
}