Jenkins CVE-2026-117614

Exploitation requires the attacker to hold Jenkins Agent/Configure permission and to supply an agent configuration containing a legacy-style launch command, which Jenkins 2.587/LTS 2.580.1 and earlier auto-converts into a Command Agent Launcher without verifying administrator approval of that command. Limiting factors: the attacker must be an authenticated user with the elevated Agent/Configure permission (not anonymous and not a bystander), so blast radius is bounded by how broadly that permission is delegated; the flaw exists only in versions from Jenkins 2.86 / LTS 2.89.1 up to 2.587 / LTS 2.580.1 because the conversion path originates from the move of this functionality into the Command Agent Launcher Plugin. The vendor states the fix is upgrading to Jenkins 2.588 or LTS 2.580.2; no separate configuration mitigation is given for this issue.

No CVSS vector, EPSS score, KEV entry, or PoC reference is provided in the input for CVE-2026-117614; the vuln.today Decision label is 'awaiting_data', so the usual exploitation-probability and prioritization signals are absent. The only severity signal is the Jenkins CNA's qualitative rating of 'High' for the other core issues in the same advisory (the advisory text captured here cuts off before the SECURITY-4123 severity line, so its specific CVSS was not retrieved). What IS firmly established from the vendor advisory is the mechanism and the privilege requirement: the backward-compatibility conversion of legacy agent launch commands into Command Agent Launcher Plugin launchers does not re-check administrator approval, so an attacker holding Agent/Configure permission can run arbitrary code in the Jenkins controller JVM - a controller-level RCE, which is among the most impactful outcomes in a CI/CD system. The real-world risk is therefore gated almost entirely by who holds Agent/Configure: this is not an anonymous or low-privilege remote flaw, so it is a privileged-insider / compromised-account escalation to full controller takeover rather than a mass-exploitable internet-facing bug. Treat it as a genuine priority in environments that delegate Agent/Configure to many or semi-trusted users, but the absence of KEV/EPSS/PoC data and the required elevated permission argue against emergency-level urgency. Note explicitly: exploitation probability is UNKNOWN here because EPSS and KEV data were not supplied, not because risk is confirmed low.

An attacker who has been granted (or has compromised an account with) Agent/Configure permission creates or reconfigures an agent using a legacy-style launch command. When Jenkins converts that configuration into a Command Agent Launcher, it skips the administrator-approval check, so the attacker's command executes in the controller JVM, yielding remote code execution on the Jenkins controller. No public exploit is identified in the provided data, and no user interaction by an administrator is described as required.