{"id":"CVE-2026-117615","kind":"vulnerability","aliases":["CVE-2026-117615"],"related":[],"title":"Jenkins: item rename follows symlinks, letting users read controller files","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, follow symbolic links when copying the directory of an item being renamed. An attacker with Item/Create and Item/Configure permission can read arbitrary files on the Jenkins controller file system.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","runtime","self-hosted"],"not_affected_if":["only-admins-create-jobs","patched-version"],"how_to_check":"- Run `jenkins --version` or check the version shown at the bottom of the Jenkins web UI and compare it to `2.587` (weekly) and `2.580.1` (LTS).\n- Check which Jenkins users hold Item/Create and Item/Configure permissions in Manage Jenkins > Security > Matrix.","fix":"- Upgrade Jenkins weekly to a release newer than `2.587`, or LTS to a release newer than `2.580.1`.\n- Until upgraded, restrict Item/Create and Item/Configure permissions to trusted users only.","status":"open","published_at":"2026-10-28T17:18:20+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:57+00:00","updated_at":"2026-10-28T17:34:57+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T17:34:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release newer than `2.587`, or LTS to a release newer than `2.580.1`.\n- Until upgraded, restrict Item/Create and Item/Configure permissions to trusted users only.","reach":"network","title":"Jenkins: item rename follows symlinks, letting users read controller files","impact":"medium","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, follow symbolic links when copying the directory of an item being renamed. An attacker with Item/Create and Item/Configure permission can read arbitrary files on the Jenkins controller file system.","category":"runtime","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Arbitrary controller files readable by an authenticated low-privilege user","analyst_note":"Confirm the fixed Jenkins weekly and LTS versions from the Jenkins security advisory; the NVD entry does not list them.","how_to_check":"- Run `jenkins --version` or check the version shown at the bottom of the Jenkins web UI and compare it to `2.587` (weekly) and `2.580.1` (LTS).\n- Check which Jenkins users hold Item/Create and Item/Configure permissions in Manage Jenkins > Security > Matrix.","needs_analyst":true,"not_affected_if":["patched-version","only-admins-create-jobs"],"who_is_affected":"Jenkins controllers at or below the listed versions where users can create or configure items. Exposure depends on users with Item/Create and Item/Configure permissions being able to rename items. Installations where only administrators can create or configure jobs have a much smaller exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3309,"output_tokens":641,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117615':13A,16A '-2026':12A,15A '2.580.1':31B,68C '2.587':26B,64C 'allow':83C 'arbitrari':55B,92C 'attack':47B,84C 'cd':19B 'ci':18B 'ci-cd':17B 'control':9A,60B,97C 'copi':38B,75C 'cve':11A,14A 'directori':40B,77C 'earlier':28B,33B,66C,70C 'file':10A,56B,61B,93C,98C 'follow':4A,34B,71C 'host':24B 'item':2A,43B,80C 'item/configure':51B,88C 'item/create':49B,86C 'jenkin':1A,20B,25B,59B,63C,96C 'let':6A 'link':36B,73C 'lts':30B,67C 'permiss':52B,89C 'read':8A,54B,91C 'renam':3A,45B,82C 'runtim':21B 'self':23B 'self-host':22B 'symbol':35B,72C 'symlink':5A 'system':62B,99C 'user':7A","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers at or below the listed versions where users can create or configure items. Exposure depends on users with Item/Create and Item/Configure permissions being able to rename items. Installations where only administrators can create or configure jobs have a much smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117615","severity":null,"published_at":"2026-10-28T17:18:20+00:00","modified_at":"2026-10-28T17:18:20+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}