Deserialization Vulnerability in Jenkins by CloudBees

CVE-2026-117612

What is CVE-2026-117612?

A deserialization vulnerability exists in Jenkins versions up to 2.587 and LTS 2.580.1 and earlier, where the deserialization filter fails to apply to classes referenced by the 'resolves-to' attribute during XStream deserialization. This flaw could potentially allow an attacker to manipulate deserialized data, leading to unauthorized access or other security issues. It is important for users and administrators to update to the latest versions of Jenkins to mitigate this vulnerability.

References