Live › vulnerability › CVE-2026-117622
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let agent processes send exceptions that implement the Stapler HttpResponse interface to the controller. An attacker who controls an agent can use this to inject cross-site scripting into the controller's web interface.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers at or below the listed versions that accept connections from agents, especially agents an organisation does not fully control. Installations with no agents, or with only fully trusted agents, have a much smaller exposure. The sources do not say whether the flaw needs any specific plugin or configuration.
No product ranges from the sources yet.
java -jar jenkins.war --version or check the version under Manage Jenkins to see whether the controller is at 2.587 or earlier, or LTS 2.580.1 or earlier.2.587 (weekly) or newer than LTS 2.580.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
This page as .md · .json · in your agent: get_signal("CVE-2026-117622")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.