Jenkins CVE-2026-117613

Attacker must hold Item/Configure permission (or an equivalent */Configure permission such as View/Configure or Agent/Configure) on a vulnerable instance - Jenkins 2.587 and earlier or LTS 2.580.1 and earlier - and use the POST config.xml API to submit a job config.xml whose crafted collection elements evade the per-converter element-type checks. Limiting factors: the actor cannot be anonymous and must already be authorized to configure items; as stored XSS it only executes when another user loads the affected page (victim interaction required); and on Jenkins 2.539+/LTS 2.541.1+ enforcing Content Security Policy protection mitigates the known impact. The advisory also notes other XSS or type-confusion variants from unexpected collection element types may be possible, but no specific additional trigger is described in the available sources.

No CVSS base vector is published for this CVE - both Jenkins advisory pages show 'CVSS Vector: N/A' and give only a qualitative 'High' rating from the Jenkins CNA, so attack-vector/complexity/privilege metrics cannot be read from the input and the 'High' label cannot be independently reconciled with a numeric score. There is no EPSS score, no CISA KEV listing, and no PoC or exploit reference among the four references (all are the oss-security post and Jenkins advisory/reporting pages), so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'awaiting_data,' consistent with the thin signal set. On substance this is a stored cross-site scripting flaw, not the remote code execution that several sibling issues in the same advisory carry: it requires an authenticated actor holding Item/Configure (or equivalent */Configure) permission to submit a crafted config.xml, and the payload only fires when another user views the affected page. Given the privileged-access and victim-interaction requirements plus an available CSP mitigation, my independent read is that real-world risk is moderate (Medium-class) rather than the 'High' qualitative label, and this issue is a lower priority than the RCE items (CVE-2026-117612/117614/117615/117616/117617) bundled in the same advisory. Note the discrepancy: vendor labels this High but publishes no vector, and a stored XSS gated by PR:L and UI:R typically scores Medium - verify the intended vector with Jenkins.

An attacker who already holds Item/Configure permission submits a crafted job config.xml through the POST config.xml API, exploiting the fact that not all XStream converters restrict collection element types; the crafted elements persist as stored content. When an administrator or other user later views the affected job page, the injected script executes in their authenticated browser session. No public exploit code was identified at the time of analysis, and the stored XSS does not fire without a victim viewing the page.