CVE-2026-117615
Jenkins: information disclosure
- Risk score
- 41/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.
- Affected
- Jenkins
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Jenkins: Yellow, plan it in. In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replace…
The flaws
- CVE-2026-117615: Information disclosure (CVSS 6.5 · EPSS 0%)
- CVE-2026-117618: Race condition (CVSS 8.1 · EPSS 0%)
- CVE-2026-117616: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-117612: Unsafe deserialisation (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Jenkins
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-59 (CWE-59). 103 other warnings in 30 days
- Same product: Earlier Jenkins warnings. 9 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.
Last activity 28 Oct 2026. Patch Forecast updates every hour.