Live › vulnerability › CVE-2026-117615
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, follow symbolic links when copying the directory of an item being renamed. An attacker with Item/Create and Item/Configure permission can read arbitrary files on the Jenkins controller file system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers at or below the listed versions where users can create or configure items. Exposure depends on users with Item/Create and Item/Configure permissions being able to rename items. Installations where only administrators can create or configure jobs have a much smaller exposure.
No product ranges from the sources yet.
jenkins --version or check the version shown at the bottom of the Jenkins web UI and compare it to 2.587 (weekly) and 2.580.1 (LTS).2.587, or LTS to a release newer than 2.580.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.
This page as .md · .json · in your agent: get_signal("CVE-2026-117615")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.