EUVD-2026-112191
GHSA-pvpc-w439-vmwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jenkins web UI
-
ExploitUse held Configure/Read permission
-
ExecutionSubmit crafted config or request (mechanism undocumented for this CVE)
-
ImpactAchieve impact on controller
Vulnerability Assessment
| Exploitation Conditions | Prerequisites specific to CVE-2026-117626 cannot be extracted - its description is not present in the supplied advisory text (coverage ends at CVE-2026-117622). As a family characteristic of this same advisory, the disclosed vulnerabilities require an authenticated Jenkins account (explicitly 'cannot be anonymous') holding permissions such as Overall/Read, Item/Configure, View/Configure, or Agent/Configure; the two stored-XSS issues in the batch are mitigated on Jenkins 2.539+/LTS 2.541.1+ when Content Security Policy enforcement is enabled. The primary limiting factor across the advisory is that exploitation requires authenticated, permissioned access rather than anonymous network access. Whether these same limits apply to CVE-2026-117626 is unverified. |
| Impact | This analysis is constrained by a significant data gap: the requested CVE-2026-117626 is NOT individually described in any of the provided sources. The supplied oss-security post and Jenkins advisory 2026-10-28 text covers SECURITY-4125/CVE-2026-117612 through SECURITY-4249/CVE-2026-117622 and is truncated before reaching CVE-2026-117626, so no description, severity, CVSS vector, affected-version range, or attribution specific to CVE-2026-117626 is available. No CVSS vector is provided in the input (advisory page shows 'CVSS Score: N/A / CVSS Vector: N/A' for the landing page, and individual sub-advisories are only labeled 'High' qualitatively). EPSS is absent, KEV status is absent, and no POC or exploit reference is present, so the exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'awaiting_data,' which is consistent with the missing per-CVE detail and means this is NOT yet a prioritized/act-now item - urgency cannot be elevated on the current evidence. For context, the sibling vulnerabilities in the same advisory are all authenticated (require Jenkins permissions such as Overall/Read, Item/Configure, or Agent/Configure - none are anonymous/unauthenticated) and several lead to RCE on the controller, which would be high-severity IF CVE-2026-117626 follows the same pattern; however, this cannot be asserted for CVE-2026-117626 specifically because its description is not in the sources. Bottom line: treat as a credible authenticated Jenkins-core issue pending the full per-CVE advisory text, but do not represent severity, vector, or mechanism as confirmed. |
| Exploit ScenarioDerived | The specific attack mechanism for CVE-2026-117626 is not described in the available sources, so a precise scenario cannot be grounded. In the same 2026-10-28 advisory, the pattern is an authenticated user holding a Jenkins permission (e.g., Overall/Read, Item/Configure, or Agent/Configure) submitting crafted configuration/serialized data or abusing an item operation to achieve stored XSS or code execution in the controller JVM. No public exploit or POC reference is provided for CVE-2026-117626. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Jenkins core 2.587 and earlier, plus LTS 2.580.1 and earlier, are the affected versions for the security batch fixed in Jenkins 2.588 and LTS 2.580.2, but the individual defect tracked as CVE-2026-117626 is not described in any of the source material available here - the supplied oss-security post and the linked Jenkins advisory 2026-10-28 both cut off at CVE-2026-117622 (SECURITY-4249). Exploitation status, CVSS, CWE and impact for this specific ID are therefore unverified: no CISA KEV entry, no confirmed working public exploit code, and no EPSS score were provided, so it should be treated as an unresolved mapping gap within an actively maintained advisory rather than as a characterized vulnerability. Analysts should read the full advisory page directly before assigning severity or exposure for this CVE. As a family characteristic of the same advisory, the sibling issues require an authenticated Jenkins account holding permissions such as Overall/Read, Item/Configure, View/Configure or Agent/Configure, and are explicitly noted as not exploitable anonymously.
RemediationAI
Upgrade to Jenkins 2.588 or Jenkins LTS 2.580.2, the releases the advisory states contain fixes for this vulnerability batch (https://www.jenkins.io/security/advisory/2026-10-28/); the advisory does not map a distinct fix to CVE-2026-117626, so verification against the full advisory page is required before treating the upgrade as closing this specific ID. The advisory documents one operational escape hatch for the new deserialization enforcement: if the added XStream type-permission system causes problems, administrators can disable it by setting the Java system property hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION to true, which restores prior behavior and therefore also removes that layer of protection. For the collection-element XSS issue in the same batch, the advisory notes that enforcing Content Security Policy mitigates the known impact on Jenkins 2.539 and newer and LTS 2.541.1 and newer. No vendor-released patch specific to CVE-2026-117626 is identified in the supplied data, and the sources do not describe compensating controls for it.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins persists configuration and build data through XStream, and hardens that path with a JEP-200 whitelist enforced by custom converters, restricting deserialization to types defined in core/plugins or explicitly allowed; the disclosed sibling issues abuse that serialization layer (SECURITY-4125 bypasses the filter for classes named in a resolves-to attribute, SECURITY-4225 bypasses collection element type restrictions leading to stored XSS) and, in 2.588/LTS 2.580.2, Jenkins additionally adopts the XStream type-permission system alongside its own converters. Other issues in the batch are outside the serializer entirely: conversion of legacy agent launch commands without administrator approval (SECURITY-4123), symlink following during item rename (SECURITY-4187), unvalidated agent-name loading from any config.xml on the controller (SECURITY-4188), a time-of-check/time-of-use gap when writing archived artifacts through symlinks (SECURITY-4248), and agent-computed workspace-browser link URLs enabling XSS (SECURITY-4232). The technical mechanism, affected component and root-cause class (CWE) for CVE-2026-117626 specifically are not stated in the available sources - the advisory text ends at CVE-2026-117622, so the trigger for this ID is not described and must not be assumed to match any of the patterns above.
Know when Jenkins gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Description PRE-NVD
Executive ViewAI
CVE-2026-117626 is an unresolved vulnerability identifier within the Jenkins core security advisory affecting versions 2.587 and earlier and LTS 2.580.1 and earlier. Because the specific defect details are undisclosed, the organizational impact cannot be fully assessed; however, the advisory family includes issues that may allow authenticated users with certain permissions to compromise Jenkins integrity. Leadership should prioritize remediating all Jenkins instances to the fixed versions to eliminate exposure to this and related vulnerabilities.
Apply vendor patch.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Exploit-DB