Deserialization Flaw in Jenkins Affects API Configurations

CVE-2026-117613

What is CVE-2026-117613?

Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier, are susceptible to a deserialization flaw that fails to limit item types during the deserialization process. This security issue enables attackers, having access to certain POST config.xml API endpoints, to upload specially crafted config.xml files. Such an oversight can facilitate various attacks, including stored cross-site scripting (XSS), potentially compromising users and systems. It is crucial for users of affected versions to update to the latest releases to mitigate these risks.

References