{
  "schema_version": 1,
  "ticket_id": "CVE-2026-84645",
  "stage": "vuln_variant",
  "verdict": "confirmed_alternate_trigger_no_fix_bypass",
  "confirmed": true,
  "variant_confirmed": true,
  "bypass_confirmed": false,
  "fixed_target_vulnerable": false,
  "summary": "A materially distinct FingerprintAction#build carrier achieved the parent RCE impact on Jenkins 2.579. The identical payload was blocked on Jenkins 2.580, and two additional fix-assumption candidates failed closed; no patch bypass was confirmed.",
  "submitted_target": {
    "repository": "https://github.com/jenkinsci/jenkins",
    "version": "2.579",
    "commit_sha": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf",
    "image_digest": "sha256:a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be"
  },
  "fixed_target": {
    "repository": "https://github.com/jenkinsci/jenkins",
    "version": "2.580",
    "commit_sha": "497de4961ad80d97e26bfdeb0d2e40442a84ecb0",
    "image_digest": "sha256:0e50a5b11ac14f3b84e529d725ed3a1c4b17ba16188dfa8d9a0189428b0839b1",
    "security_fix_commit": "0d731367e08656f8cd1e8275f0e820f97af07fc6"
  },
  "validated_candidates": [
    {
      "candidate_id": "fingerprint-action-build",
      "classification": "confirmed_alternate_data_path_on_vulnerable_target",
      "same_root_cause": true,
      "same_trust_boundary": true,
      "vulnerable_result": "rce_confirmed",
      "fixed_result": "blocked",
      "vulnerable_route_status": 200,
      "fixed_route_status": 404,
      "vulnerable_marker_present": true,
      "fixed_marker_present": false,
      "impact": "Groovy execution, controller-local unique marker creation, and id as uid=1000(jenkins)"
    },
    {
      "candidate_id": "parameters-action-run",
      "classification": "negative_newly_routable_fixed_surface",
      "same_root_cause": true,
      "vulnerable_result": "not_routable_no_public_getter",
      "fixed_result": "blocked_before_route",
      "vulnerable_route_status": 404,
      "fixed_route_status": 404,
      "vulnerable_marker_present": false,
      "fixed_marker_present": false
    },
    {
      "candidate_id": "reference-and-replacer-exception-confusion",
      "classification": "negative_fix_assumption_test",
      "same_root_cause": true,
      "vulnerable_result": "no_forged_root",
      "fixed_result": "no_forged_root",
      "marker_present": false,
      "notes": "An incompatible reference= plus class= and a nonexistent Run$Replacer identifier did not produce a routable attacker-created root."
    }
  ],
  "script_contract": {
    "path": "bundle/vuln_variant/reproduction_steps.sh",
    "expected_exit_code_for_this_verdict": 1,
    "first_run_exit_code": 1,
    "second_run_exit_code": 1,
    "idempotent": true,
    "crashed": false
  },
  "blocking_mitigation": "The fixed RobustReflectionConverter structural check and targeted XStreamNotDeserializable annotations remove the nested Run/Job/Hudson values, so Stapler returns 404 and no controller marker is created.",
  "impact_parity_on_confirmed_alternate_trigger": "full",
  "impact_parity_on_fixed_target": "none",
  "evidence": [
    "bundle/logs/vuln_variant/proof/vulnerable.fingerprint.route.response.body",
    "bundle/logs/vuln_variant/proof/vulnerable.fingerprint.observation.json",
    "bundle/logs/vuln_variant/proof/fixed.fingerprint.observation.json",
    "bundle/logs/vuln_variant/proof/fixed.fingerprint.config.after.xml",
    "bundle/logs/vuln_variant/proof/fixed.parameters.observation.json",
    "bundle/logs/vuln_variant/proof/fixed.exceptions.fingerprints.marker_absent.txt",
    "bundle/logs/vuln_variant/fixed_version.txt",
    "bundle/logs/vuln_variant/reproduction_first.log",
    "bundle/logs/vuln_variant/reproduction_second.log"
  ]
}