---
id: "CVE-2026-117613"
kind: "vulnerability"
aliases: ["CVE-2026-117613"]
title: "Jenkins: crafted config.xml uploads enable stored XSS via item types"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "only-admins-can-configure-jobs"]
published_at: "2026-10-28T17:18:20+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:35:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117613", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: crafted config.xml uploads enable stored XSS via item types

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not restrict item types in collections after deserialization. An attacker with permission to POST config.xml to the API can submit crafted files that lead to stored cross-site scripting, such as script running in other users' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Jenkins version at the bottom of any Jenkins page or with `jenkins-cli.jar version`, and compare it against `2.587` (weekly) and `2.580.1` (LTS)
- Review which accounts hold Item/Create or Job/Configure permissions and can POST to config.xml endpoints
- unknown for any other specific check; the sources do not list a file or setting to inspect

## Fix

- Upgrade Jenkins weekly to a release later than `2.587`
- Upgrade Jenkins LTS to a release later than `2.580.1`
- unknown for a specific fixed version number; the sources do not name one

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117613

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_