Live › vulnerability › CVE-2026-117612
Go to dashboardJenkins does not apply its XStream deserialization filter to classes referenced by the resolves-to attribute, so the filter that normally blocks dangerous classes is bypassed for them. The sources do not say what an attacker gets beyond the deserialization bypass, so code execution is not confirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams running Jenkins weekly at 2.587 or earlier, or LTS at 2.580.1 or earlier, are exposed to the filter bypass. Whether an outside attacker can reach the vulnerable XStream path depends on who can send data to the Jenkins controller, which the sources do not describe. Teams on newer releases can skip this.
No product ranges from the sources yet.
jenkins-cli version or the footer of the web UI, and compare it against 2.587 (weekly) and 2.580.1 (LTS).2.587, or LTS to a release later than 2.580.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the resolves-to attribute during XStream deserialization.
This page as .md · .json · in your agent: get_signal("CVE-2026-117612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.