CVE-2026-117618: Race Condition
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Jenkins instances running version 2.587 or earlier, or LTS 2.580.1 or earlier, are affected during initial setup while the first user account is being replaced.
What does an attacker need to exploit it?
An attacker does not need authentication. They must be able to send requests to the HTTP endpoint for creating the first user account during the race window.
What is the impact of a successful exploit?
A successful attacker can create an administrator account, giving them administrative access to the Jenkins instance.