Live › vulnerability › CVE-2026-117624
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not consistently block deserialization of object types that store configuration in top-level files when they appear as nested values. An attacker who can supply configuration data can bypass the root element check and inject nested objects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers running the affected weekly or LTS lines are in scope. The sources do not describe which configurations or plugins make the bypass reachable, so the exact exposure is unknown. Teams on newer Jenkins releases can skip it.
No product ranges from the sources yet.
jenkins --version or check the version shown at the bottom of the Jenkins web UI and compare it with 2.587 (weekly) and 2.580.1 (LTS)2.5872.580.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
This page as .md · .json · in your agent: get_signal("CVE-2026-117624")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.