What is the CVSS score of CVE-2026-53441?

CVE-2026-53441 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-53441?

Yes, a patch is available for CVE-2026-53441. Update the affected software to the latest version immediately.

Jenkins CVE-2026-53441

EUVD-2026-36025 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 jenkins

GHSA-93qh-vwrm-c5pw

Jenkins XSS

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects mandatory Agent/Configure permission; UI:R captures required victim page view; S:C models cross-user browser-session scope change inherent to stored XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 18:08 vuln.today

CVSS changed

Jun 15, 2026 - 18:07 NVD

5.4 (MEDIUM)

CVE Published

Jun 10, 2026 - 13:06 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.jenkins-ci.main:jenkins-core (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.483.

DescriptionNVD

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

AnalysisAI

Stored XSS in Jenkins 2.483-2.567 and LTS 2.492.1-2.555.2 allows attackers holding Agent/Configure permission to inject persistent malicious scripts via the POST config.xml API by supplying an unescaped generic offline cause description. When any Jenkins user views the affected agent page, the payload executes in their browser, enabling session hijacking or unauthorized actions within the Jenkins instance. No public exploit or CISA KEV listing has been identified, and EPSS probability is low at 0.02%, reflecting the constrained attack surface from the required permission prerequisite.

Technical ContextAI

Jenkins (CPE: cpe:2.3:a:jenkins_project:jenkins) is a widely deployed open-source CI/CD automation server that exposes a POST config.xml REST API allowing users to configure agent (node) settings programmatically. One configurable field is the 'generic offline cause' description, which is displayed in the Jenkins web UI when an agent goes offline. The server fails to apply HTML entity encoding or output sanitization before rendering this field, constituting a CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) defect. Because the malicious payload is persisted server-side and replayed to any user who loads the affected page, this is a stored/persistent XSS variant with cross-user impact, reflected in the CVSS 3.1 S:C (scope changed) metric.

RemediationAI

Upgrade Jenkins to weekly release 2.568 or LTS release 2.555.3, both confirmed as patched versions per EUVD-2026-36025 and the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3731. If immediate patching is not feasible, revoke or restrict Agent/Configure permission from any user who does not strictly require it, directly eliminating the attacker-controlled input vector; note this may disrupt legitimate agent management workflows and should be coordinated with operations teams. As a defense-in-depth measure, enforcing Jenkins' built-in Content Security Policy (CSP) header (configurable via 'Manage Jenkins > Script Console') can limit inline script execution and reduce XSS impact, though this does not patch the underlying encoding defect and may break some Jenkins plugins or UI features. No workaround fully substitutes for the vendor patch.