CVE-2026-117622: XSS
Published Oct 28, 2026
·Updated
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
Affected Software
1 affected component
Jenkins Jenkins<=2.587, <=2.580.1
Event History
Oct 28, 2026
CVE Published
via MITRE·04:48 PM
Data Sourced
via MITRE·04:48 PM
Description
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must be in control of a Jenkins agent process. The issue is exploitable through an affected agent sending a crafted exception to the Jenkins controller.
2
Which Jenkins installations are affected?
Jenkins versions 2.587 and earlier and LTS versions 2.580.1 and earlier are affected.
3
What is the impact of successful exploitation?
Successful exploitation results in a cross-site scripting vulnerability on the Jenkins controller.