CVE-2026-117622
Jenkins: cross-site scripting
- Risk score
- 41/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
- Affected
- Jenkins
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Jenkins: Amber, patch this week. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when tha…
The flaws
- CVE-2026-117622: Cross-site scripting (CVSS 6.1 · EPSS 0%)
- CVE-2026-117616: Path traversal can lead to remote code execution (CVSS 8.8 · EPSS 1%)
- CVE-2026-117614: Missing authorisation can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-117612: Unsafe deserialisation (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Jenkins
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
- Same product: Earlier Jenkins warnings. 9 in the last 90 days
Why it is Yellow
- CVSS 6.1 medium
References
Original description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
Last activity 28 Oct 2026. Patch Forecast updates every hour.