{"id":"CVE-2026-117614","kind":"vulnerability","aliases":["CVE-2026-117614"],"related":[],"title":"Jenkins: older agent configs run arbitrary commands on the controller","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, turn launch commands from older agent configurations into Command Agent Launcher Plugin launchers without checking administrator approval. An attacker with Agent/Configure permission can execute arbitrary code inside the Jenkins controller JVM.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","runtime","self-hosted"],"not_affected_if":["default-config","newer-release"],"how_to_check":"- Run `jenkins-cli version` or read the version shown at the bottom of the Jenkins web UI and compare it with `2.587` (weekly) or `2.580.1` (LTS)\n- Check whether the Command Agent Launcher Plugin is installed under Manage Jenkins > Plugins\n- Review which users hold Agent/Configure permission under Manage Jenkins > Security > Matrix or Role-based strategy","fix":"- Upgrade Jenkins core to a release newer than `2.587` (weekly) or newer than `2.580.1` (LTS); the sources do not name the exact fixed version\n- Restrict Agent/Configure permission to trusted administrators until the upgrade is applied","status":"open","published_at":"2026-10-28T17:18:20+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:59+00:00","updated_at":"2026-10-28T17:34:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T17:34:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins core to a release newer than `2.587` (weekly) or newer than `2.580.1` (LTS); the sources do not name the exact fixed version\n- Restrict Agent/Configure permission to trusted administrators until the upgrade is applied","reach":"network","title":"Jenkins: older agent configs run arbitrary commands on the controller","impact":"high","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, turn launch commands from older agent configurations into Command Agent Launcher Plugin launchers without checking administrator approval. An attacker with Agent/Configure permission can execute arbitrary code inside the Jenkins controller JVM.","category":"runtime","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code inside the Jenkins controller JVM","analyst_note":"Find the fixed Jenkins core versions and the Command Agent Launcher Plugin fixed version in the Jenkins security advisory linked from the NVD entry.","how_to_check":"- Run `jenkins-cli version` or read the version shown at the bottom of the Jenkins web UI and compare it with `2.587` (weekly) or `2.580.1` (LTS)\n- Check whether the Command Agent Launcher Plugin is installed under Manage Jenkins > Plugins\n- Review which users hold Agent/Configure permission under Manage Jenkins > Security > Matrix or Role-based strategy","needs_analyst":true,"not_affected_if":["default-config","newer-release"],"who_is_affected":"Jenkins controllers on weekly 2.587 or earlier, or LTS 2.580.1 or earlier, where users hold Agent/Configure permission and older agent configurations exist. Controllers where only administrators can edit agents, or that run a newer release, are less exposed. The sources do not say whether plugin-only installs without the Command Agent Launcher Plugin are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":3338,"output_tokens":749,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117614':13A,16A '-2026':12A,15A '2.580.1':31B,70C '2.587':26B,66C 'administr':49B,99C 'agent':3A,39B,43B,79C,87C 'agent/configure':54B,103C 'allow':100C 'approv':50B,96C 'arbitrari':6A,58B,107C 'attack':52B,101C 'cd':19B 'check':48B,91C 'ci':18B 'ci-cd':17B 'code':59B,108C 'command':7A,36B,42B,76C,86C 'config':4A 'configur':40B,80C 'context':111C 'control':10A,63B,115C 'convert':73C 'cve':11A,14A 'earlier':28B,33B,68C,72C 'execut':57B,106C 'host':24B 'insid':60B 'jenkin':1A,20B,25B,62B,65C,114C 'jvm':64B,116C 'launch':35B,75C 'launcher':44B,46B,82C,88C 'lts':30B,69C 'older':2A,38B,78C 'permiss':55B,104C 'plugin':45B,89C 'provid':83C 'run':5A 'runtim':21B 'self':23B 'self-host':22B 'turn':34B 'whether':92C 'without':47B,90C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers on weekly 2.587 or earlier, or LTS 2.580.1 or earlier, where users hold Agent/Configure permission and older agent configurations exist. Controllers where only administrators can edit agents, or that run a newer release, are less exposed. The sources do not say whether plugin-only installs without the Command Agent Launcher Plugin are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117614","severity":null,"published_at":"2026-10-28T17:18:20+00:00","modified_at":"2026-10-28T17:18:20+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}