CVE-2026-117616: Jenkins Jenkins vulnerability
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Overall/Read permission in Jenkins. The issue is therefore relevant where users or service accounts have read access but should not be able to load or modify arbitrary agent configurations.
What access does an attacker need to exploit it?
The attacker must be able to access the affected HTTP endpoint and have Overall/Read permission. They can load a config.xml file from the controller file system as an agent configuration and, when saving that agent, overwrite an arbitrary config.xml file.
What is the potential impact?
Overwriting an arbitrary config.xml file can potentially result in arbitrary code execution on the Jenkins controller.
Which Jenkins releases are affected?
Jenkins 2.587 and earlier, and Jenkins LTS 2.580.1 and earlier, are affected.