CVE-2026-117620: Jenkins Jenkins vulnerability

Q: Who can exploit this issue?

An attacker needs Overall/Read permission in Jenkins. The issue depends on an administrator acting on warnings generated through the Manage Old Data feature.

Q: What is the likely impact if an administrator acts on the warning?

Attacker-controlled data can be injected to override existing user account information, including login passwords.

Q: Are installations on the affected release lines exposed by default?

The provided information identifies Jenkins 2.587 and earlier and LTS 2.580.1 and earlier as affected, but does not state whether any additional configuration is required beyond the described permissions and administrator interaction.

Published Oct 28, 2026

Updated

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.

Affected Software

1 affected component

Jenkins Jenkins<=2.587, <=2.580.1

Event History

Oct 28, 2026

CVE Published

via MITRE·04:48 PM

Data Sourced

via MITRE·04:48 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker needs Overall/Read permission in Jenkins. The issue depends on an administrator acting on warnings generated through the Manage Old Data feature.

What is the likely impact if an administrator acts on the warning?

Attacker-controlled data can be injected to override existing user account information, including login passwords.

Are installations on the affected release lines exposed by default?

The provided information identifies Jenkins 2.587 and earlier and LTS 2.580.1 and earlier as affected, but does not state whether any additional configuration is required beyond the described permissions and administrator interaction.

CVE-2026-117620: Jenkins Jenkins vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if an administrator acts on the warning?

Are installations on the affected release lines exposed by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if an administrator acts on the warning?

Are installations on the affected release lines exposed by default?