EUVD-2026-112189
GHSA-xh58-qv89-v6gq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jenkins with low-privilege account
-
DeliveryObtain Item/Configure or Overall/Read permission
-
ExploitSubmit crafted config.xml or endpoint request
-
ExecutionTrigger permission-gated flaw on controller
-
ImpactImpact not confirmed for this CVE (sibling CVEs reach controller-JVM RCE)
Vulnerability Assessment
| Exploitation Conditions | Cannot be stated for CVE-2026-117624 specifically: the available sources do not describe this identifier, so its exact prerequisite feature, permission, or configuration is not determinable. For context, every described sibling vulnerability in the 2026-10-28 advisory requires authenticated access plus a specific Jenkins permission (e.g., Overall/Read, Item/Configure, View/Configure, Agent/Configure, or Item/Create) rather than anonymous remote access, and two XSS siblings (CVE-2026-117613, CVE-2026-117621) are mitigated by enforcing Content Security Policy on Jenkins 2.539+/LTS 2.541.1+. Whether these same limiting factors apply to CVE-2026-117624 is unverified. The complete fix per the vendor is upgrading to Jenkins 2.588 or LTS 2.580.2. |
| Impact | This analysis is constrained by a significant data gap: the specific identifier under review, CVE-2026-117624, does NOT appear in the provided advisory text. The supplied material is the Jenkins Security Advisory 2026-10-28 bundle, which individually describes CVE-2026-117612 through CVE-2026-117622 (the text is truncated at SECURITY-4249/CVE-2026-117622); CVE-2026-117624 is presumably part of the same advisory but its description, severity, and mechanism are not included here, so its individual attack vector cannot be confirmed. On the signals that ARE present: there is no CVSS vector (advisory page returns N/A), no EPSS score, no CISA KEV listing, and no POC/exploit reference - the vuln.today Decision label is explicitly 'awaiting_data'. Exploitation status is therefore 'no public exploit identified at time of analysis'. The sibling vulnerabilities in this advisory are uniformly rated High and share a consistent pattern: they are NOT remote-unauthenticated, but require authenticated access with specific Jenkins permissions (Overall/Read, Item/Configure, Agent/Configure, or Item/Create), several escalating to RCE in the controller JVM. If CVE-2026-117624 follows the same advisory pattern it would be a High-severity, permission-gated issue - serious for any Jenkins instance with semi-trusted users, but not internet-wide wormable. However, this is an inference from the sibling CVEs, not a confirmed property of 117624. Priority should be treated as 'patch promptly' (upgrade to the fixed releases) given the advisory's overall RCE exposure, while recognizing the real-world risk for this specific CVE cannot be scored from the available data. |
| Exploit ScenarioDerived | The specific trigger for CVE-2026-117624 is not described in the available sources. Based on the advisory pattern, an authenticated user holding a Jenkins */Configure or Overall/Read permission could submit crafted configuration or interact with a controller endpoint; several sibling vulnerabilities in this same advisory escalate such access to code execution in the controller JVM. No public exploit code or POC reference is provided for this identifier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Jenkins core 2.587 and earlier and Jenkins LTS 2.580.1 and earlier are covered by the vendor's 2026-10-28 security advisory, which bundles fixes for several distinct flaws into Jenkins 2.588 and LTS 2.580.2; the identifier CVE-2026-117624 does not appear anywhere in the supplied advisory text, so its specific defect, prerequisites and severity could not be verified from the available sources. The sibling issues that are described are not anonymously reachable - they require an authenticated account plus a Jenkins permission such as Overall/Read, Item/Configure, View/Configure, Agent/Configure or Item/Create - and several of them can end in code execution in the controller JVM or in cross-site scripting. No public exploit code and no CISA KEV entry were identified for this identifier, no EPSS score was supplied, and the priority label is awaiting_data; the vendor advisory at https://www.jenkins.io/security/advisory/2026-10-28/ is the authoritative reference.
RemediationAI
The vendor's complete fix is to upgrade Jenkins core to 2.588 or Jenkins LTS to 2.580.2, the releases named in the 2026-10-28 advisory - but note that the mapping of CVE-2026-117624 to those releases is unverified, so confirm the identifier against the full advisory at https://www.jenkins.io/security/advisory/2026-10-28/ before closing it out. For the two XSS-class siblings in that advisory (CVE-2026-117613, CVE-2026-117621), the vendor states that enforcing Content Security Policy on Jenkins 2.539+/LTS 2.541.1+ mitigates the known impact; this is a partial control for those issues, not a substitute for upgrading, and CSP enforcement can break inlining-dependent plugin UI, so it should be rolled out in report-only mode first. Jenkins 2.588/LTS 2.580.2 additionally introduce the XStream type-permission system, and the advisory offers the Java system property hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION=true as a compatibility escape hatch if that system causes problems - setting it re-widens the deserialization surface, so it should be treated as a temporary, tracked exception rather than a hardening measure. As a general exposure reduction for the permission-gated issues described, audit which accounts hold Overall/Read, Item/Create, Item/Configure, View/Configure and Agent/Configure, since every described sibling requires one of those rather than anonymous access. No workaround specific to CVE-2026-117624 can be stated, because the flaw itself is not described in the available data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins persists configuration and build data through XStream, and since JEP-200 it wraps deserialization in a custom filter that only permits types defined in core or plugins, or types explicitly allowlisted; the historical attack surface is grounded in #readResolve behaviour executed during deserialization. The advisory documents several distinct root causes in that area and around controller file-system handling: the custom XStream converter failed to apply the deserialization filter to classes named by the resolves-to attribute (SECURITY-4125); collection element types were not uniformly restricted by all converters, allowing crafted job config.xml documents (SECURITY-4225); legacy agent launch commands were converted into Command Agent Launcher Plugin launchers without checking administrator approval (SECURITY-4123); item rename copied directories while following symbolic links (SECURITY-4187); an HTTP endpoint loaded agents by unvalidated name, permitting arbitrary config.xml files to be read as agent configuration and later overwritten (SECURITY-4188); archive extraction checked for symlinks only before creating parent directories rather than immediately before writing, and allowed symlinks in artifacts to replace existing files or empty directories (SECURITY-4248); and the workspace browser trusted agent-computed link URLs, producing XSS (SECURITY-4232). No CWE identifier, CPE string or CVSS vector was supplied for CVE-2026-117624, and the mechanism by which that specific identifier is triggered is not described in the available sources.
Know when Jenkins gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Executive ViewAI
A critical-severity vulnerability in Jenkins core potentially affects our build and deployment pipelines, though the specific flaw remains unverified due to conflicting vendor advisory data. Leadership should care because if the defect permits code execution or cross-site scripting (as sibling issues do), it could compromise the integrity of our software delivery process and expose sensitive credentials.
No vendor-released patch identified at time of analysis for CVE-2026-117624; interim mitigations include restricting Jenkins access to authenticated users with least privilege, network segmentation to limit exposure, and close monitoring of the vendor advisory for updates.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Exploit-DB