---
id: "CVE-2026-117624"
kind: "vulnerability"
aliases: ["CVE-2026-117624"]
title: "Jenkins: incomplete deserialization check lets attackers inject nested configuration objects"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ci-cd", "infrastructure", "jenkins", "self-hosted"]
not_affected_if: ["newer-jenkins-release"]
published_at: "2026-10-28T17:18:21+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117624", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Jenkins: incomplete deserialization check lets attackers inject nested configuration objects

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, do not consistently block deserialization of object types that store configuration in top-level files when they appear as nested values. An attacker who can supply configuration data can bypass the root element check and inject nested objects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `jenkins --version` or check the version shown at the bottom of the Jenkins web UI and compare it with `2.587` (weekly) and `2.580.1` (LTS)
- unknown for other checks, the sources do not say

## Fix

- Upgrade Jenkins weekly to a release later than `2.587`
- Upgrade Jenkins LTS to a release later than `2.580.1`
- unknown for the exact fixed version, the sources do not say

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117624

## From the sources

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_