Symbolic Link Vulnerability in Jenkins by CloudBees
CVE-2026-117615

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins
Vendor
CVE Published:
28 October 2026

What is CVE-2026-117615?

A vulnerability in Jenkins allows attackers with Item/Create and Item/Configure permission to exploit symbolic links when renaming directories. This can lead to unauthorized access to arbitrary files on the Jenkins controller file system, potentially exposing sensitive information. It is crucial for users to update to patched versions to safeguard against this risk.

Affected Version(s)

Jenkins 2.588

Jenkins 2.588

Jenkins 2.580.2 < 2.580.*

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.