CVE-2026-117621
Jenkins: cross-site scripting
- Risk score
- 41/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
- Affected
- Jenkins
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Jenkins: Amber, patch this week. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when tha…
The flaws
- CVE-2026-117621: Cross-site scripting (CVSS 6.1 · EPSS 0%)
- CVE-2026-117616: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 1%)
- CVE-2026-117614: Missing authorisation can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-117612: Unsafe deserialisation (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Jenkins
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
- Same product: Earlier Jenkins warnings. 9 in the last 90 days
Why it is Yellow
- CVSS 6.1 medium
References
Original description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
Last activity 28 Oct 2026. Patch Forecast updates every hour.