{"id":"CVE-2026-117624","kind":"vulnerability","aliases":["CVE-2026-117624"],"related":[],"title":"Jenkins: incomplete deserialization check lets attackers inject nested configuration objects","description":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not consistently block deserialization of object types that store configuration in top-level files when they appear as nested values. An attacker who can supply configuration data can bypass the root element check and inject nested objects.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","infrastructure","jenkins","self-hosted"],"not_affected_if":["newer-jenkins-release"],"how_to_check":"- Run `jenkins --version` or check the version shown at the bottom of the Jenkins web UI and compare it with `2.587` (weekly) and `2.580.1` (LTS)\n- unknown for other checks, the sources do not say","fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- unknown for the exact fixed version, the sources do not say","status":"open","published_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:47+00:00","updated_at":"2026-10-28T17:34:47+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T17:34:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jenkins weekly to a release later than `2.587`\n- Upgrade Jenkins LTS to a release later than `2.580.1`\n- unknown for the exact fixed version, the sources do not say","reach":"unknown","title":"Jenkins: incomplete deserialization check lets attackers inject nested configuration objects","impact":"medium","summary":"Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not consistently block deserialization of object types that store configuration in top-level files when they appear as nested values. An attacker who can supply configuration data can bypass the root element check and inject nested objects.","category":"infrastructure","nicknames":[],"who_cares":["jenkins","self-hosted","ci-cd"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown impact on the Jenkins controller beyond injected configuration objects","analyst_note":"Check the Jenkins security advisory and the NVD entry for the fixed versions, the required privileges, and the reachable configuration path.","how_to_check":"- Run `jenkins --version` or check the version shown at the bottom of the Jenkins web UI and compare it with `2.587` (weekly) and `2.580.1` (LTS)\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["newer-jenkins-release"],"who_is_affected":"Jenkins controllers running the affected weekly or LTS lines are in scope. The sources do not describe which configurations or plugins make the bypass reachable, so the exact exposure is unknown. Teams on newer Jenkins releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000638,"input_tokens":3318,"output_tokens":612,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117624':13A,16A '-2026':12A,15A '2.580.1':31B,78C '2.587':26B,74C 'allow':107C 'appear':52B 'attack':6A,57B,108C 'block':37B 'bypass':64B,110C 'cd':19B 'check':4A,68B,114C 'ci':18B 'ci-cd':17B 'configur':9A,44B,61B,96C,102C 'consist':36B,83C 'cve':11A,14A 'data':62B 'deseri':3A,38B,88C 'earlier':28B,33B,76C,80C 'element':67B,113C 'enforc':84C 'file':49B,103C 'host':24B 'incomplet':2A 'independ':98C 'infrastructur':20B 'inject':7A,70B,117C 'jenkin':1A,21B,25B,73C 'let':5A 'level':48B,101C 'lts':30B,77C 'mark':92C 'nest':8A,54B,71B,105C,118C 'object':10A,40B,72B,89C,119C 'potenti':116C 'restrict':86C 'root':66B,112C 'self':23B 'self-host':22B 'store':43B,94C 'suppli':60B 'top':47B,100C 'top-level':46B,99C 'type':41B,91C 'valu':55B,106C","nicknames":[],"mitigations":[],"who_affected":"Jenkins controllers running the affected weekly or LTS lines are in scope. The sources do not describe which configurations or plugins make the bypass reachable, so the exact exposure is unknown. Teams on newer Jenkins releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117624","severity":null,"published_at":"2026-10-28T17:18:21+00:00","modified_at":"2026-10-28T17:18:21+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}