Live › vulnerability › CVE-2026-117625
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, fail to check permissions on a path that exposes the configured HTTP proxy. A user with Overall/Read permission can read the proxy server, port, user name and no-proxy host list.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins instances that have an HTTP proxy configured and grant Overall/Read to users who should not see proxy settings. Instances without a configured proxy, or where Overall/Read is limited to trusted users, have little to lose. The sources do not name the specific endpoint.
No product ranges from the sources yet.
java -jar jenkins.war --version or check the version shown under Manage Jenkins to see whether the instance is at or below 2.587 (weekly) or 2.580.1 (LTS)2.587, or LTS to a release newer than 2.580.1; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.
This page as .md · .json · in your agent: get_signal("CVE-2026-117625")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.