Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626)
Severity: high · Patch status: patched · Since 2026-10-28 · CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, CVE-2026-117621, CVE-2026-117622, CVE-2026-117623, CVE-2026-117624, CVE-2026-117625, CVE-2026-117626
On 2026-10-28 the Jenkins project published advisory 2026-10-28, which fixes 15 vulnerabilities in Jenkins core (13 rated High, 2 Medium) in weekly 2.588 and LTS 2.580.2. Every earlier release is affected. Most of the bugs give a logged-in user with modest permissions control of the controller. CVE-2026-117612 (CVSS 8.8): the XStream converter skipped the JEP-200 deserialization filter for classes named in a resolves-to attribute. A user with Overall/Read who can POST a config.xml can instantiate arbitrary types, which can lead to RCE. CVE-2026-117614: Agent/Configure was enough to run arbitrary code on the controller, because legacy agent launch commands were converted without script approval. CVE-2026-117616: an HTTP endpoint loaded any config.xml on disk as an agent, and saving that agent overwrites a file of the attacker's choosing. Two symlink bugs give arbitrary file read on job rename (CVE-2026-117615) and arbitrary file write by racing parallel artifact archiving (CVE-2026-117617). Both can lead to RCE. Account takeover issues: CVE-2026-117618 is a race in the setup wizard. While the initial admin is being replaced, an unauthenticated attacker can create an administrator account, so a fresh controller reachable from the internet is at risk. CVE-2026-117620 lets a user plant a 'Manage Old Data' entry; when an admin acts on it, a user's password is overwritten. CVE-2026-117619 lets a revoked API token keep its access through a 'remember me' cookie. The rest are stored XSS (config.xml collection elements, breadcrumb tooltips; CVE-2026-117613, -117623), XSS from compromised agents (CVE-2026-117621, -117622), a PersistenceRoot nesting bypass (CVE-2026-117624), and two information leaks (HTTP proxy settings and $JENKINSHOME file listings; CVE-2026-117625, -117626). Many reports came from Anthropic's OSS program; others came from independent researchers. No exploitation is known. Upgrading is the fix. On 2.539+/LTS 2.541.1+, enforcing CSP mitigates the XSS issues.
What to do
- Upgrade controllers to Jenkins 2.588 (weekly) or 2.580.2 (LTS). Every earlier version is affected, and only the upgrade closes the RCE paths.
- Take the controller off the public internet. Most of these bugs need only a low-privilege account, and CVE-2026-117618 needs none, so internet exposure is the biggest risk multiplier. If it is public only so GitHub, GitLab, Bitbucket or Gitea webhooks can reach it, use the Webhook Relay plugin (https://plugins.jenkins.io/webhook-relay, setup: https://webhookrelay.com/docs/tutorials/cicd/jenkins-plugin/). The plugin opens an outbound WebSocket to a relay bucket and replays only webhook deliveries to the SCM endpoint (e.g. /github-webhook/). No inbound port is opened, so the UI, the config.xml APIs and the setup wizard are not reachable from outside.
- Never leave a new controller on a reachable network while the setup wizard is unfinished (CVE-2026-117618). Finish setup on an isolated network, or with the admin created through JCasC.
- Until you have upgraded, cut Overall/Read for anonymous users and audit who holds Item/Configure, Agent/Configure and View/Configure. Those permissions are the entry point for the XStream, agent-launch and symlink RCEs.
- Look for tampering: agents with unexpected launch commands or new names, config.xml changes made through the REST API, new admin or user accounts, and any 'Manage Old Data' warnings. Do not act on Old Data warnings you cannot explain (CVE-2026-117620).
- Revoke and re-issue API tokens you suspect are exposed, and invalidate sessions as well. Revoking a token did not end 'remember me' cookies obtained with it (CVE-2026-117619).
- On 2.539+/LTS 2.541.1+, enforce Content Security Policy to blunt the stored XSS issues. Treat build agents as untrusted, because a compromised agent could inject XSS into the controller UI (CVE-2026-117621/-117622).
Fixed versions
- Jenkins weekly 2.588
- Jenkins LTS 2.580.2
Sources
All live incidents on Threat Watch
