---
id: "CVE-2026-117614"
kind: "vulnerability"
aliases: ["CVE-2026-117614"]
title: "Jenkins: older agent configs run arbitrary commands on the controller"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "runtime", "self-hosted"]
not_affected_if: ["default-config", "newer-release"]
published_at: "2026-10-28T17:18:20+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117614", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: older agent configs run arbitrary commands on the controller

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, turn launch commands from older agent configurations into Command Agent Launcher Plugin launchers without checking administrator approval. An attacker with Agent/Configure permission can execute arbitrary code inside the Jenkins controller JVM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `jenkins-cli version` or read the version shown at the bottom of the Jenkins web UI and compare it with `2.587` (weekly) or `2.580.1` (LTS)
- Check whether the Command Agent Launcher Plugin is installed under Manage Jenkins > Plugins
- Review which users hold Agent/Configure permission under Manage Jenkins > Security > Matrix or Role-based strategy

## Fix

- Upgrade Jenkins core to a release newer than `2.587` (weekly) or newer than `2.580.1` (LTS); the sources do not name the exact fixed version
- Restrict Agent/Configure permission to trusted administrators until the upgrade is applied

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117614

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_