{"id":"CVE-2026-117613","kind":"vulnerability","aliases":["CVE-2026-117613"],"related":[],"title":"Jenkins: crafted config.xml uploads enable stored XSS via item types","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not restrict item types in collections after deserialization. An attacker with permission to POST config.xml to the API can submit crafted files that lead to stored cross-site scripting, such as script running in other users' browsers.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","runtime","self-hosted"],"not_affected_if":["managed-hosting","only-admins-can-configure-jobs"],"how_to_check":"- Check the running Jenkins version at the bottom of any Jenkins page or with `jenkins-cli.jar version`, and compare it against `2.587` (weekly) and `2.580.1` (LTS)\n- Review which accounts hold Item/Create or Job/Configure permissions and can POST to config.xml endpoints\n- unknown for any other specific check; the sources do not list a file or setting to inspect","fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- unknown for a specific fixed version number; the sources do not name one","status":"open","published_at":"2026-10-28T17:18:20+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:35:01+00:00","updated_at":"2026-10-28T17:35:01+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T17:35:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- unknown for a specific fixed version number; the sources do not name one","reach":"network","title":"Jenkins: crafted config.xml uploads enable stored XSS via item types","impact":"medium","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not restrict item types in collections after deserialization. An attacker with permission to POST config.xml to the API can submit crafted files that lead to stored cross-site scripting, such as script running in other users' browsers.","category":"runtime","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.5,"needs_auth":"yes","worst_case":"Stored script runs in other users' browsers on the Jenkins site","analyst_note":"Confirm fixed versions and the exact permission required at https://nvd.nist.gov/vuln/detail/CVE-2026-117613 and the linked Jenkins security advisory.","how_to_check":"- Check the running Jenkins version at the bottom of any Jenkins page or with `jenkins-cli.jar version`, and compare it against `2.587` (weekly) and `2.580.1` (LTS)\n- Review which accounts hold Item/Create or Job/Configure permissions and can POST to config.xml endpoints\n- unknown for any other specific check; the sources do not list a file or setting to inspect","needs_analyst":true,"not_affected_if":["managed-hosting","only-admins-can-configure-jobs"],"who_is_affected":"Jenkins controllers at or below the affected versions are exposed when users with access to the config.xml API endpoints can create or change jobs. Instances where only trusted administrators can write job configuration are at lower risk. unknown whether a default install is exposed; the sources do not say.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":3323,"output_tokens":701,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117613':13A,16A '-2026':12A,15A '2.580.1':31B,78C '2.587':26B,74C 'access':93C 'allow':90C 'api':52B,97C 'attack':44B,91C 'browser':72B 'cd':19B 'ci':18B 'ci-cd':17B 'collect':40B,87C 'config.xml':3A,49B,96C,102C 'craft':2A,55B,101C 'cross':62B,111C 'cross-sit':61B,110C 'cve':11A,14A 'deseri':42B,89C 'e.g':108C 'earlier':28B,33B,76C,80C 'enabl':5A 'endpoint':98C 'file':56B,103C 'host':24B 'item':9A,37B,84C 'jenkin':1A,20B,25B,73C 'lead':58B,106C 'lts':30B,77C 'permiss':46B 'post':48B,95C 'restrict':36B,83C 'run':68B 'runtim':21B 'script':64B,67B,113C 'self':23B 'self-host':22B 'site':63B,112C 'store':6A,60B,109C 'submit':54B,100C 'type':10A,38B,85C 'upload':4A 'user':71B 'via':8A 'vulner':115C 'xss':7A,114C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers at or below the affected versions are exposed when users with access to the config.xml API endpoints can create or change jobs. Instances where only trusted administrators can write job configuration are at lower risk. unknown whether a default install is exposed; the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117613","severity":null,"published_at":"2026-10-28T17:18:20+00:00","modified_at":"2026-10-28T17:18:20+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}