CVE-2026-117614: Jenkins Jenkins vulnerability
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Agent/Configure permission. Successful exploitation allows arbitrary code execution in the context of the Jenkins controller JVM.
Are older agent configurations relevant?
Yes. The issue occurs when Jenkins converts launch commands in older agent configurations into launchers supplied by the Command Agent Launcher Plugin without verifying administrator approval.
How can I determine whether my Jenkins instance is affected?
Instances running Jenkins 2.587 or earlier, or LTS 2.580.1 or earlier, are affected according to the provided information. Review whether users with Agent/Configure permission can modify older agent configurations containing launch commands.