Live › vulnerability › CVE-2026-117614
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, turn launch commands from older agent configurations into Command Agent Launcher Plugin launchers without checking administrator approval. An attacker with Agent/Configure permission can execute arbitrary code inside the Jenkins controller JVM.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers on weekly 2.587 or earlier, or LTS 2.580.1 or earlier, where users hold Agent/Configure permission and older agent configurations exist. Controllers where only administrators can edit agents, or that run a newer release, are less exposed. The sources do not say whether plugin-only installs without the Command Agent Launcher Plugin are affected.
No product ranges from the sources yet.
jenkins-cli version or read the version shown at the bottom of the Jenkins web UI and compare it with 2.587 (weekly) or 2.580.1 (LTS)2.587 (weekly) or newer than 2.580.1 (LTS); the sources do not name the exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
This page as .md · .json · in your agent: get_signal("CVE-2026-117614")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.