CVE-2026-117625: Jenkins Jenkins vulnerability

Q: Who can exploit this issue?

Any attacker who has Jenkins Overall/Read permission can obtain the configured HTTP proxy's server, port, user name, and no-proxy host list. No higher Jenkins permission is stated as required.

Q: Are default Jenkins installations affected?

The exposed information is associated with a configured HTTP proxy. The provided information does not indicate exposure when no HTTP proxy is configured.

Q: How can I determine whether my Jenkins instance is affected?

Jenkins 2.587 and earlier, or Jenkins LTS 2.580.1 and earlier, are affected according to the advisory. Review whether users granted Overall/Read should be able to view details of a configured HTTP proxy.

Published Oct 28, 2026

Updated

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.

Affected Software

1 affected component

Jenkins Jenkins<=2.587, <=2.580.1

Event History

Oct 28, 2026

CVE Published

via MITRE·04:48 PM

Data Sourced

via MITRE·04:48 PM

Description

Frequently Asked Questions

Who can exploit this issue?

Any attacker who has Jenkins Overall/Read permission can obtain the configured HTTP proxy's server, port, user name, and no-proxy host list. No higher Jenkins permission is stated as required.

Are default Jenkins installations affected?

The exposed information is associated with a configured HTTP proxy. The provided information does not indicate exposure when no HTTP proxy is configured.

How can I determine whether my Jenkins instance is affected?

Jenkins 2.587 and earlier, or Jenkins LTS 2.580.1 and earlier, are affected according to the advisory. Review whether users granted Overall/Read should be able to view details of a configured HTTP proxy.