---
id: "CVE-2026-117618"
kind: "vulnerability"
aliases: ["CVE-2026-117618"]
title: "Jenkins: setup endpoint lets unauthenticated attackers create an administrator account"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "package", "self-hosted"]
not_affected_if: ["patched-version", "setup-completed"]
published_at: "2026-10-28T17:18:21+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117618", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: setup endpoint lets unauthenticated attackers create an administrator account

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, have an HTTP endpoint for creating the first user that does not check whether the setup wizard is finished. A race during the replacement of the initial account lets an unauthenticated attacker create an administrator account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Jenkins version with `jenkins-cli version` or on the Manage Jenkins page; affected are `2.587` and earlier and LTS `2.580.1` and earlier.
- Check whether the setup wizard is still reachable: unknown if the sources give a path or setting to test.

## Fix

- Upgrade Jenkins weekly to a release newer than `2.587` or LTS to a release newer than `2.580.1`; the exact fixed version is unknown from the sources.
- Review the user list in Manage Jenkins > Users for unexpected administrator accounts and remove any you do not recognise.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117618

## From the sources

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_