Live › vulnerability › CVE-2026-117616
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, have an HTTP endpoint that loads agents by name without validating the name. An attacker with Overall/Read permission can load any config.xml on the controller as an agent configuration and overwrite an arbitrary config.xml when that agent is saved, which can lead to arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers running weekly 2.587 or earlier, or LTS 2.580.1 or earlier, where users other than administrators hold Overall/Read permission. Controllers where only trusted users can log in face lower risk. Sources do not specify the fixed release numbers.
No product ranges from the sources yet.
java -jar jenkins.war --version or open Manage Jenkins to read the Jenkins version and compare it with 2.587 (weekly) and 2.580.1 (LTS)2.5872.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-117616")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.