CVE-2026-117623: XSS
Published Oct 28, 2026
·Updated
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
Affected Software
1 affected component
Jenkins Jenkins<=2.587, <=2.580.1
Event History
Oct 28, 2026
CVE Published
via MITRE·04:48 PM
Data Sourced
via MITRE·04:48 PM
Description
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker needs Overall/Read permission in Jenkins. The issue is a stored XSS vulnerability in breadcrumb bar overflow menu tooltips.
2
Which Jenkins versions are affected?
Jenkins 2.587 and earlier, and Jenkins LTS 2.580.1 and earlier, are affected.