CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

EUVD-2026-112187

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622

Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) are vulnerable to a cross-site scripting (XSS) vulnerability (CVE-2026-117622 ). The root cause allows agents to send exceptions that implement the Stapler HttpResponse interface back to the controller. This can be exploited ...

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-117622: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

PT-2026-128310

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

XSS vulnerability in handling of agent errors

To protect against deserialization vulnerabilities, Jenkins restricts the types of objects that agents can send to the controller https://jenkins.io/jep/200JEP-200. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities stem from the ability of agents to send abnormal requests to controllers that implement the Stapler HttpResponse interface, potentially allowing attackers controlling th...

CVE-2026-84659

A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows an attacker to bypass security restrictions by disabling the global script sandbox. By exploiting a missing permission check through Stapler data binding, an attacker can execute arbitrary code, potentially...

Exploit for Deserialization of Untrusted Data in Jenkins

Jenkins Stapler RCE CVE-2018-1000861 Vulhubhttps://vulhu...

CVE-2026-84654

A flaw was found in Stapler, a web framework used by Jenkins. This vulnerability allows an attacker, who can submit configuration forms, to modify public static fields of configuration objects. This modification can lead to changes that apply globally across the entire Jenkins instance, potential...

Jenkins Stapler Groovy RCE (CVE-2018-1000861)

Exploits CVE-2018-1000861 in Jenkins =2.153 / LTS =2.138.3: ACL bypass on descriptorByName endpoints allows Groovy execution via checkScriptCompile. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins Stapler ACL bypass Groovy RCE CVE-2018-1000861.""" import re import urllib.parse from kittysplo...

Jenkins (Stapler): Deserialization

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

BIT-JENKINS-2026-84654

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting public static fields of the bound configuration object, allowing attackers who can submit configuration forms to modify publi...

BIT-JENKINS-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

BIT-JENKINS-2026-84647

In Stapler 2107.v8dfcbe8ed317 and earlier, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...

BIT-JENKINS-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

PT-2026-88162

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

PT-2026-88164

In Stapler 2107.v8dfcb e8ed317 and earlier, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to those compatible with the expected field type, allowing...