CVE-2026-117624: Jenkins Jenkins vulnerability
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
Affected Software
Event History
Frequently Asked Questions
Which Jenkins installations are affected?
Jenkins 2.587 and earlier, and Jenkins LTS 2.580.1 and earlier, are affected.
What does an attacker need to do to exploit this issue?
The issue involves deserializing nested objects whose types are marked to store configuration in independent top-level configuration files. An attacker would need a path that causes Jenkins to deserialize such nested configuration data in order to bypass the root element check and potentially inject nested objects.
What is the security impact of successful exploitation?
Successful exploitation can bypass the root element check during deserialization and potentially allow injection of nested objects.