{"id":"CVE-2026-117623","kind":"vulnerability","aliases":["CVE-2026-117623"],"related":[],"title":"Jenkins: breadcrumb tooltip text lets readers run stored cross-site scripting","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not escape text shown in breadcrumb bar overflow menu tooltips. An attacker with Overall/Read permission can store script that runs in other users' browsers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","jenkins","package","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Run `jenkins-cli version` or open the Jenkins footer to read the running version\n- Compare the running version against `2.587` (weekly) and `2.580.1` (LTS)","fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- Check the Jenkins security advisory for the exact fixed version (unknown in the sources)","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:47+00:00","updated_at":"2026-10-28T17:34:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:34:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- Check the Jenkins security advisory for the exact fixed version (unknown in the sources)","reach":"network","title":"Jenkins: breadcrumb tooltip text lets readers run stored cross-site scripting","impact":"medium","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not escape text shown in breadcrumb bar overflow menu tooltips. An attacker with Overall/Read permission can store script that runs in other users' browsers.","category":"package","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"script runs in other users' browsers, possibly stealing their sessions","analyst_note":"Confirm the fixed Jenkins weekly and LTS versions from the Jenkins security advisory, and whether any setting is needed to expose the breadcrumb overflow menu.","how_to_check":"- Run `jenkins-cli version` or open the Jenkins footer to read the running version\n- Compare the running version against `2.587` (weekly) and `2.580.1` (LTS)","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Jenkins controllers at or below the listed versions where users with Overall/Read permission can reach the breadcrumb bar and its overflow menu. Instances on newer weekly or LTS releases are not affected. The sources do not say whether unauthenticated users can trigger it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3327,"output_tokens":609,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117623':15A,18A '-2026':14A,17A '2.580.1':33B,66C '2.587':28B,62C 'attack':48B,96C 'bar':43B,80C 'breadcrumb':2A,42B,79C 'browser':60B 'cd':21B 'ci':20B 'ci-cd':19B 'cross':10A,89C 'cross-sit':9A,88C 'cve':13A,16A 'earlier':30B,35B,64C,68C 'entri':83C 'escap':38B,71C 'exploit':94C 'host':26B 'jenkin':1A,22B,27B,61C 'let':5A 'lts':32B,65C 'menu':45B,82C 'overall/read':50B,98C 'overflow':44B,81C 'packag':23B 'permiss':51B,99C 'reader':6A 'result':84C 'run':7A,56B 'script':12A,54B,91C 'self':25B 'self-host':24B 'shown':40B,74C 'site':11A,90C 'store':8A,53B,87C 'text':4A,39B,73C 'tooltip':3A,46B,77C 'user':59B 'vulner':93C 'xss':92C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers at or below the listed versions where users with Overall/Read permission can reach the breadcrumb bar and its overflow menu. Instances on newer weekly or LTS releases are not affected. The sources do not say whether unauthenticated users can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117623","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}