{"id":"CVE-2026-117619","kind":"vulnerability","aliases":["CVE-2026-117619"],"related":[],"title":"Jenkins: API token requests issue a remember-me cookie that outlives revocation","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a \"remember me\" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a \"remember me\" cookie after the API token is revoked or expires.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let requests authenticated with HTTP Basic auth, including an API token, obtain a \"remember me\" cookie. An attacker who has a user's API token can keep access through that cookie after the token is revoked or expires.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","runtime","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Run `jenkins-cli version` or check the version under Manage Jenkins; compare against `2.587` (weekly) and `2.580.1` (LTS)\n- unknown for whether remember-me cookies were already issued to other sessions","fix":"- Upgrade Jenkins weekly to a release newer than `2.587`, or LTS to a release newer than `2.580.1`\n- Revoke and regenerate any API tokens that may have been exposed, and invalidate existing sessions","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:52+00:00","updated_at":"2026-10-28T17:34:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T17:34:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release newer than `2.587`, or LTS to a release newer than `2.580.1`\n- Revoke and regenerate any API tokens that may have been exposed, and invalidate existing sessions","reach":"network","title":"Jenkins: API token requests issue a remember-me cookie that outlives revocation","impact":"high","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let requests authenticated with HTTP Basic auth, including an API token, obtain a \"remember me\" cookie. An attacker who has a user's API token can keep access through that cookie after the token is revoked or expires.","category":"runtime","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker keeps Jenkins access as the user after the API token is revoked","analyst_note":"Check the Jenkins security advisory for the fixed versions and exact configuration requirements; the NVD entry gives no fixed version.","how_to_check":"- Run `jenkins-cli version` or check the version under Manage Jenkins; compare against `2.587` (weekly) and `2.580.1` (LTS)\n- unknown for whether remember-me cookies were already issued to other sessions","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Any Jenkins controller running a weekly release at or below 2.587 or an LTS release at or below 2.580.1 where users authenticate with API tokens over HTTP Basic auth. Instances that do not accept Basic auth for API calls are less exposed, but the sources do not say which configurations are exempt.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3339,"output_tokens":631,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117619':16A,19A '-2026':15A,18A '2.580.1':34B,80C '2.587':29B,76C 'access':64B,113C 'allow':83C,101C 'api':2A,46B,60B,93C,109C,123C 'attack':54B,102C 'auth':43B 'authent':39B,85C,89C 'basic':42B,88C 'cd':22B 'ci':21B 'ci-cd':20B 'cooki':10A,52B,67B,100C,120C 'cve':14A,17A 'earlier':31B,36B,78C,82C 'expir':74B,128C 'host':27B 'http':41B,87C 'includ':44B,90C 'issu':5A 'jenkin':1A,23B,28B,75C,115C 'keep':63B 'let':37B 'lts':33B,79C 'obtain':48B,96C,105C 'outliv':12A 'rememb':8A,50B,98C,118C 'remember-m':7A 'request':4A,38B,84C 'retain':112C 'revoc':13A 'revok':72B,126C 'runtim':24B 'self':26B 'self-host':25B 'token':3A,47B,61B,70B,94C,110C,124C 'use':86C,116C 'user':58B,107C","nicknames":[],"mitigations":[],"who_affected":"Any Jenkins controller running a weekly release at or below 2.587 or an LTS release at or below 2.580.1 where users authenticate with API tokens over HTTP Basic auth. Instances that do not accept Basic auth for API calls are less exposed, but the sources do not say which configurations are exempt.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117619","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}