Live › vulnerability › CVE-2026-117613
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not restrict item types in collections after deserialization. An attacker with permission to POST config.xml to the API can submit crafted files that lead to stored cross-site scripting, such as script running in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers at or below the affected versions are exposed when users with access to the config.xml API endpoints can create or change jobs. Instances where only trusted administrators can write job configuration are at lower risk. unknown whether a default install is exposed; the sources do not say.
No product ranges from the sources yet.
jenkins-cli.jar version, and compare it against 2.587 (weekly) and 2.580.1 (LTS)2.5872.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.
This page as .md · .json · in your agent: get_signal("CVE-2026-117613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.