{"id":"CVE-2026-117622","kind":"vulnerability","aliases":["CVE-2026-117622"],"related":[],"title":"Jenkins: agent-sent exceptions enable cross-site scripting on the controller","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let agent processes send exceptions that implement the Stapler HttpResponse interface to the controller. An attacker who controls an agent can use this to inject cross-site scripting into the controller's web interface.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","other","self-hosted"],"not_affected_if":["fully-trusted-agents","no-agents"],"how_to_check":"- Run `java -jar jenkins.war --version` or check the version under Manage Jenkins to see whether the controller is at `2.587` or earlier, or LTS `2.580.1` or earlier.\n- Confirm whether untrusted or less-trusted build agents connect to the controller.","fix":"- Upgrade Jenkins to a version newer than `2.587` (weekly) or newer than LTS `2.580.1`.\n- unknown: the sources do not name the exact fixed versions.","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:50+00:00","updated_at":"2026-10-28T17:34:50+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T17:34:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins to a version newer than `2.587` (weekly) or newer than LTS `2.580.1`.\n- unknown: the sources do not name the exact fixed versions.","reach":"network","title":"Jenkins: agent-sent exceptions enable cross-site scripting on the controller","impact":"medium","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let agent processes send exceptions that implement the Stapler HttpResponse interface to the controller. An attacker who controls an agent can use this to inject cross-site scripting into the controller's web interface.","category":"other","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker-controlled agent injects script into the controller web interface","analyst_note":"Check the Jenkins security advisory for fixed versions, the exact agent-side requirements, and whether user interaction is needed; the NVD entry gives none of these.","how_to_check":"- Run `java -jar jenkins.war --version` or check the version under Manage Jenkins to see whether the controller is at `2.587` or earlier, or LTS `2.580.1` or earlier.\n- Confirm whether untrusted or less-trusted build agents connect to the controller.","needs_analyst":true,"not_affected_if":["no-agents","fully-trusted-agents"],"who_is_affected":"Jenkins controllers at or below the listed versions that accept connections from agents, especially agents an organisation does not fully control. Installations with no agents, or with only fully trusted agents, have a much smaller exposure. The sources do not say whether the flaw needs any specific plugin or configuration.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3318,"output_tokens":638,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117622':16A,19A '-2026':15A,18A '2.580.1':34B,77C '2.587':29B,73C 'agent':3A,38B,56B,81C,108C 'agent-s':2A 'allow':80C 'attack':52B,104C 'cd':22B 'ci':21B 'ci-cd':20B 'control':13A,50B,54B,68B,92C,106C 'cross':8A,63B,97C 'cross-sit':7A,62B,96C 'cve':14A,17A 'earlier':31B,36B,75C,79C 'enabl':6A 'except':5A,41B,84C 'exploit':102C 'host':27B 'httprespons':46B,88C 'implement':43B,85C 'inject':61B 'interfac':47B,71B,89C 'jenkin':1A,23B,28B,72C 'let':37B 'lts':33B,76C 'process':39B,109C 'result':93C 'script':10A,65B,99C 'self':26B 'self-host':25B 'send':40B,83C 'sent':4A 'site':9A,64B,98C 'stapler':45B,87C 'use':58B 'vulner':101C 'web':70B 'xss':100C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers at or below the listed versions that accept connections from agents, especially agents an organisation does not fully control. Installations with no agents, or with only fully trusted agents, have a much smaller exposure. The sources do not say whether the flaw needs any specific plugin or configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117622","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}