{"id":"CVE-2026-117618","kind":"vulnerability","aliases":["CVE-2026-117618"],"related":[],"title":"Jenkins: setup endpoint lets unauthenticated attackers create an administrator account","description":"In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, have an HTTP endpoint for creating the first user that does not check whether the setup wizard is finished. A race during the replacement of the initial account lets an unauthenticated attacker create an administrator account.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","package","self-hosted"],"not_affected_if":["patched-version","setup-completed"],"how_to_check":"- Check the running Jenkins version with `jenkins-cli version` or on the Manage Jenkins page; affected are `2.587` and earlier and LTS `2.580.1` and earlier.\n- Check whether the setup wizard is still reachable: unknown if the sources give a path or setting to test.","fix":"- Upgrade Jenkins weekly to a release newer than `2.587` or LTS to a release newer than `2.580.1`; the exact fixed version is unknown from the sources.\n- Review the user list in Manage Jenkins > Users for unexpected administrator accounts and remove any you do not recognise.","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:54+00:00","updated_at":"2026-10-28T17:34:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:34:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release newer than `2.587` or LTS to a release newer than `2.580.1`; the exact fixed version is unknown from the sources.\n- Review the user list in Manage Jenkins > Users for unexpected administrator accounts and remove any you do not recognise.","reach":"internet","title":"Jenkins: setup endpoint lets unauthenticated attackers create an administrator account","impact":"high","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, have an HTTP endpoint for creating the first user that does not check whether the setup wizard is finished. A race during the replacement of the initial account lets an unauthenticated attacker create an administrator account.","category":"package","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker gains administrator access to the Jenkins controller","analyst_note":"Find the Jenkins security advisory for this CVE to confirm the fixed versions and whether the flaw applies only before setup completes.","how_to_check":"- Check the running Jenkins version with `jenkins-cli version` or on the Manage Jenkins page; affected are `2.587` and earlier and LTS `2.580.1` and earlier.\n- Check whether the setup wizard is still reachable: unknown if the sources give a path or setting to test.","needs_analyst":true,"not_affected_if":["patched-version","setup-completed"],"who_is_affected":"Jenkins instances at or below the listed versions where the setup wizard has not been completed, or where the initial account is being replaced, are exposed to the race. Instances already past setup and running a newer release are not affected by this description; the sources do not say more about who is at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3323,"output_tokens":656,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117618':13A,16A '-2026':12A,15A '2.580.1':31B,76C '2.587':26B,72C 'account':10A,61B,69B,87C,111C,116C 'administr':9A,68B,110C 'allow':104C 'attack':6A,65B,106C 'cd':19B 'check':46B,90C 'ci':18B 'ci-cd':17B 'complet':97C 'condit':102C 'creat':7A,39B,66B,83C,108C 'cve':11A,14A 'earlier':28B,33B,74C,78C 'endpoint':3A,37B,81C 'finish':52B 'first':41B,85C 'host':24B 'http':36B,80C 'initi':60B,114C 'jenkin':1A,20B,25B,71C 'let':4A,62B 'lts':30B,75C 'packag':21B 'race':54B,101C 'replac':57B,119C 'result':98C 'self':23B 'self-host':22B 'setup':2A,49B,93C 'unauthent':5A,64B,105C 'user':42B,86C,115C 'whether':47B,91C 'wizard':50B,94C","nicknames":[],"mitigations":[],"who_affected":"Jenkins instances at or below the listed versions where the setup wizard has not been completed, or where the initial account is being replaced, are exposed to the race. Instances already past setup and running a newer release are not affected by this description; the sources do not say more about who is at risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117618","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}