Code Execution Vulnerability in Jenkins from Insecure Command Execution

CVE-2026-117614

What is CVE-2026-117614?

Jenkins versions 2.587 and earlier, as well as LTS version 2.580.1 and earlier, are susceptible to a code execution vulnerability. The issue arises due to the conversion of launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin, which fails to verify if these commands have been sanctioned by an administrator. This oversight permits attackers with Agent/Configure permissions to potentially execute arbitrary code within the Jenkins controller's JVM, posing a serious security risk.

References