Live › vulnerability › CVE-2026-117621
Go to dashboardJenkins computes the URL for each file and directory link in the workspace browser on the agent rather than on the controller. An attacker who controls an agent process can inject script into those links, which runs in the browser of a user viewing the workspace.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers running versions at or below 2.587 (weekly) or 2.580.1 (LTS) where users browse agent workspaces. The attacker must control an agent process, so controllers using only trusted agents are at lower risk. Teams that run only fully trusted agents and restrict workspace browsing can deprioritise this.
No product ranges from the sources yet.
jenkins --version or the footer of the web UI; affected are 2.587 and earlier and LTS 2.580.1 and earlier.2.587.2.580.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
This page as .md · .json · in your agent: get_signal("CVE-2026-117621")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.