Live › vulnerability › CVE-2026-117618
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, have an HTTP endpoint for creating the first user that does not check whether the setup wizard is finished. A race during the replacement of the initial account lets an unauthenticated attacker create an administrator account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins instances at or below the listed versions where the setup wizard has not been completed, or where the initial account is being replaced, are exposed to the race. Instances already past setup and running a newer release are not affected by this description; the sources do not say more about who is at risk.
No product ranges from the sources yet.
jenkins-cli version or on the Manage Jenkins page; affected are 2.587 and earlier and LTS 2.580.1 and earlier.2.587 or LTS to a release newer than 2.580.1; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.
This page as .md · .json · in your agent: get_signal("CVE-2026-117618")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.