CVE-2026-117615: Jenkins Jenkins vulnerability

Q: What level of access does an attacker need?

An attacker needs both Item/Create and Item/Configure permission.

Q: What systems and data are exposed if exploited?

The issue can allow reading arbitrary files from the Jenkins controller file system.

Q: Which Jenkins releases are affected?

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, are affected.

Published Oct 28, 2026

Updated

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

Affected Software

1 affected component

Jenkins Jenkins<=2.587, <=2.580.1

Event History

Oct 28, 2026

CVE Published

via MITRE·04:48 PM

Data Sourced

via MITRE·04:48 PM

Description

Frequently Asked Questions

What level of access does an attacker need?

An attacker needs both Item/Create and Item/Configure permission.

What systems and data are exposed if exploited?

The issue can allow reading arbitrary files from the Jenkins controller file system.

Which Jenkins releases are affected?

Jenkins 2.587 and earlier, and LTS 2.580.1 and earlier, are affected.

CVE-2026-117615: Jenkins Jenkins vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

What systems and data are exposed if exploited?

Which Jenkins releases are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What systems and data are exposed if exploited?

Which Jenkins releases are affected?