CVE-2026-117613: XSS
Published Oct 28, 2026
·Updated
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.
Affected Software
1 affected component
Jenkins Jenkins<=2.587, <=2.580.1
Event History
Oct 28, 2026
CVE Published
via MITRE·04:48 PM
Data Sourced
via MITRE·04:48 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs access to Jenkins POST config.xml API endpoints and must be able to submit a crafted config.xml file.
2
What systems are affected?
Jenkins 2.587 and earlier, and Jenkins LTS 2.580.1 and earlier, are affected.
3
What is the likely impact of a successful exploit?
A crafted configuration can cause unsupported item types to remain in collections after deserialization, which can lead to stored cross-site scripting vulnerabilities.