---
id: "CVE-2026-117621"
kind: "vulnerability"
aliases: ["CVE-2026-117621"]
title: "Jenkins: workspace browser link computed on agent enables cross-site scripting"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-28T17:18:21+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117621", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: workspace browser link computed on agent enables cross-site scripting

Jenkins computes the URL for each file and directory link in the workspace browser on the agent rather than on the controller. An attacker who controls an agent process can inject script into those links, which runs in the browser of a user viewing the workspace.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Jenkins version with `jenkins --version` or the footer of the web UI; affected are 2.587 and earlier and LTS 2.580.1 and earlier.
- Identify agents that run untrusted builds or are shared across trust boundaries, since only attackers in control of agent processes can exploit this.

## Fix

- Upgrade Jenkins weekly line to a release later than `2.587`.
- Upgrade the LTS line to a release later than `2.580.1`.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117621

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_