HTTP Endpoint Vulnerability in Jenkins for Agent Configuration Loading

CVE-2026-117616

What is CVE-2026-117616?

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, are affected by a vulnerability that allows unauthorized users to exploit an HTTP endpoint. This endpoint can load agent configurations by name without proper validation, which could enable attackers with Overall/Read permissions to access and modify sensitive config.xml files. Such actions may lead to the execution of arbitrary code, compromising the security of the Jenkins controller environment. This issue emphasizes the need for validating input data in configurations to prevent unauthorized access and potential malicious activities.

References