Live › vulnerability › CVE-2026-117626
Go to dashboardJenkins 2.587 and earlier, and LTS 2.580.1 and earlier, fail to correctly detect path traversal in the file browser for workspaces and the userContent directory. An attacker with Overall/Read permission can list names, sizes and modification times of files in JENKINS_HOME, and one with Item/Workspace permission can learn names of jobs that have workspaces on the same agent.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Jenkins controllers running core at or below 2.587 or LTS at or below 2.580.1 are exposed. The risk applies mainly where many users hold Overall/Read or Item/Workspace, and the file browser is reachable. Instances with tightly restricted permissions face little practical exposure.
No product ranges from the sources yet.
java -jar jenkins.war --version2.587 (weekly) or newer than 2.580.1 (LTS), per the Jenkins security advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
This page as .md · .json · in your agent: get_signal("CVE-2026-117626")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.