CVE-2026-117619: Jenkins Jenkins vulnerability
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already possess a Jenkins user's API token and be able to authenticate to Jenkins using HTTP Basic authentication. The issue lets them convert that token-based access into a persistent "remember me" cookie.
What happens if the compromised API token is revoked or expires?
Revoking or allowing the API token to expire may not end the attacker's access if they already obtained a "remember me" cookie. The cookie can retain their Jenkins access after the token is no longer valid.
Which Jenkins installations are affected?
Jenkins 2.587 and earlier, and Jenkins LTS 2.580.1 and earlier, are affected when requests can authenticate with HTTP Basic authentication, including API-token authentication.