Live › vulnerability › CVE-2026-117623
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not escape text shown in breadcrumb bar overflow menu tooltips. An attacker with Overall/Read permission can store script that runs in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers at or below the listed versions where users with Overall/Read permission can reach the breadcrumb bar and its overflow menu. Instances on newer weekly or LTS releases are not affected. The sources do not say whether unauthenticated users can trigger it.
No product ranges from the sources yet.
jenkins-cli version or open the Jenkins footer to read the running version2.587 (weekly) and 2.580.1 (LTS)2.5872.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
This page as .md · .json · in your agent: get_signal("CVE-2026-117623")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.