CVE-2026-117614

Jenkins: missing authorisation can lead to remote code execution

Risk score: 46/100
CVSS: 7.2 v3.1
Exploit chance (30 days): 0.2%
Published: 28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code i…
Affected: Jenkins
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Jenkins: Yellow, plan it in. In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replace…

The flaws

CVE-2026-117614: Missing authorisation can lead to remote code execution (CVSS 7.2 · EPSS 0%)
CVE-2026-117618: Race condition (CVSS 8.1 · EPSS 0%)
CVE-2026-117616: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-117612: Unsafe deserialisation (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Jenkins

Where it stands

No known exploitation

Connects to

Same weakness: Missing authorisation (CWE-862). 399 other warnings in 30 days
Same product: Earlier Jenkins warnings. 9 in the last 90 days

Why it is Yellow

CVSS 7.2 high

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4123

Original description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Last activity 28 Oct 2026. Patch Forecast updates every hour.