{"id":"CVE-2026-117620","kind":"vulnerability","aliases":["CVE-2026-117620"],"related":[],"title":"Jenkins: low-privilege users can trigger admin warnings that overwrite account data","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the \"Manage Old Data\" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let a user with only Overall/Read permission trigger warnings in the Manage Old Data feature. An administrator who acts on those warnings can be tricked into injecting attacker-controlled data that overrides existing user account information, including login passwords.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","runtime","self-hosted"],"not_affected_if":["no-untrusted-users","patched-version"],"how_to_check":"- `jenkins.war --version` or the version shown under Manage Jenkins, compared against `2.587` (weekly) and `2.580.1` (LTS)\n- Check whether the Manage Old Data page is reachable and in use on the instance (unknown from the sources)","fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- Unknown from the sources which exact fixed versions were released","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:52+00:00","updated_at":"2026-10-28T17:34:52+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T17:34:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- Unknown from the sources which exact fixed versions were released","reach":"network","title":"Jenkins: low-privilege users can trigger admin warnings that overwrite account data","impact":"high","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let a user with only Overall/Read permission trigger warnings in the Manage Old Data feature. An administrator who acts on those warnings can be tricked into injecting attacker-controlled data that overrides existing user account information, including login passwords.","category":"runtime","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker overrides account data, including passwords, and may take over admin accounts.","analyst_note":"Confirm fixed Jenkins weekly and LTS versions and whether the Manage Old Data action needs admin confirmation; check the Jenkins security advisory for this CVE.","how_to_check":"- `jenkins.war --version` or the version shown under Manage Jenkins, compared against `2.587` (weekly) and `2.580.1` (LTS)\n- Check whether the Manage Old Data page is reachable and in use on the instance (unknown from the sources)","needs_analyst":true,"not_affected_if":["patched-version","no-untrusted-users"],"who_is_affected":"Jenkins controllers at or below the listed versions where users hold Overall/Read permission and administrators use the Manage Old Data feature. Instances that restrict Overall/Read or never use Manage Old Data have a smaller exposure. The sources do not say more.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3323,"output_tokens":654,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117620':16A,19A '-2026':15A,18A '2.580.1':34B,82C '2.587':29B,78C 'account':12A,72B,115C 'act':55B,102C 'admin':8A 'administr':53B,105C 'allow':85C 'attack':65B,86C,109C 'attacker-control':64B,108C 'cd':22B 'ci':21B 'ci-cd':20B 'control':66B,110C 'cve':14A,17A 'data':13A,50B,67B,97C,111C 'earlier':31B,36B,80C,84C 'exist':70B,113C 'featur':51B,98C 'host':27B 'includ':74B,117C 'inform':73B,116C 'inject':63B,107C 'jenkin':1A,23B,28B,77C 'let':37B 'login':75B,118C 'low':3A 'low-privileg':2A 'lts':33B,81C 'manag':48B,95C 'old':49B,96C 'overall/read':42B,88C 'overrid':69B,112C 'overwrit':11A 'password':76B,119C 'permiss':43B,89C 'privileg':4A 'runtim':24B 'self':26B 'self-host':25B 'trick':61B 'trigger':7A,44B,91C 'user':5A,39B,71B,114C 'warn':9A,45B,58B,92C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers at or below the listed versions where users hold Overall/Read permission and administrators use the Manage Old Data feature. Instances that restrict Overall/Read or never use Manage Old Data have a smaller exposure. The sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117620","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}