---
id: "CVE-2026-117622"
kind: "vulnerability"
aliases: ["CVE-2026-117622"]
title: "Jenkins: agent-sent exceptions enable cross-site scripting on the controller"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ci-cd", "jenkins", "other", "self-hosted"]
not_affected_if: ["fully-trusted-agents", "no-agents"]
published_at: "2026-10-28T17:18:21+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117622", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: agent-sent exceptions enable cross-site scripting on the controller

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, let agent processes send exceptions that implement the Stapler HttpResponse interface to the controller. An attacker who controls an agent can use this to inject cross-site scripting into the controller's web interface.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `java -jar jenkins.war --version` or check the version under Manage Jenkins to see whether the controller is at `2.587` or earlier, or LTS `2.580.1` or earlier.
- Confirm whether untrusted or less-trusted build agents connect to the controller.

## Fix

- Upgrade Jenkins to a version newer than `2.587` (weekly) or newer than LTS `2.580.1`.
- unknown: the sources do not name the exact fixed versions.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117622

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_