CVE-2026-117616

A flaw was found in Jenkins. An authenticated attacker with Overall/Read permissions can exploit an unvalidated HTTP endpoint to achieve arbitrary code execution on the Jenkins controller. By supplying a crafted agent name, an attacker can load arbitrary configuration files from the controller fi...

CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy...

CVE-2026-117625

A missing permission check in Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) allows authenticated users with Overall/Read permissions to access sensitive HTTP proxy configuration details . This flaw results in information disclosure , as attackers can view the proxy serve...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117616

Jenkins versions 2.587 and earlier , as well as LTS 2.580.1 and earlier , are vulnerable to a path traversal flaw. The issue stems from an HTTP endpoint that loads agents by name without proper validation. This allows an attacker with Overall/Read permissions to load any config.xml file from the ...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

EUVD-2026-112181

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...

PT-2026-128304

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An HTTP endpoint loads agents by name without proper validation, enabling a path traversal attack. An attacker with Overall/Read permission can load any config.x...

CVE-2026-117623: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

CVE-2026-117620: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise because the HTTP endpoint fails to validate names when loading agents by name. Attackers with Overall/Read permissions can load any config.xml file on the controll...

PT-2026-128308

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description Users with Overall/Read permission can trigger warnings within the "Manage Old Data" feature. If an administrator acts upon these crafted warnings, it allows the...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise because attackers with Overall/Read permissions can trigger warnings within the “Manage Old Data” feature. After administrators process these warnings, they can...

CVE-2026-117616: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary...