Live › vulnerability › CVE-2026-117620
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let a user with only Overall/Read permission trigger warnings in the Manage Old Data feature. An administrator who acts on those warnings can be tricked into injecting attacker-controlled data that overrides existing user account information, including login passwords.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers at or below the listed versions where users hold Overall/Read permission and administrators use the Manage Old Data feature. Instances that restrict Overall/Read or never use Manage Old Data have a smaller exposure. The sources do not say more.
No product ranges from the sources yet.
jenkins.war --version or the version shown under Manage Jenkins, compared against 2.587 (weekly) and 2.580.1 (LTS)2.5872.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.
This page as .md · .json · in your agent: get_signal("CVE-2026-117620")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.