Live › vulnerability › CVE-2026-117619
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let requests authenticated with HTTP Basic auth, including an API token, obtain a "remember me" cookie. An attacker who has a user's API token can keep access through that cookie after the token is revoked or expires.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Any Jenkins controller running a weekly release at or below 2.587 or an LTS release at or below 2.580.1 where users authenticate with API tokens over HTTP Basic auth. Instances that do not accept Basic auth for API calls are less exposed, but the sources do not say which configurations are exempt.
No product ranges from the sources yet.
jenkins-cli version or check the version under Manage Jenkins; compare against 2.587 (weekly) and 2.580.1 (LTS)2.587, or LTS to a release newer than 2.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.
This page as .md · .json · in your agent: get_signal("CVE-2026-117619")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.