CVE-2026-117613

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to a flaw where the system fails to restrict item types in collections following deserialization . An attacker with access to POST config.xml API endpoints can submit a crafted config.xml file, potentially leading t...