Race Condition in Jenkins Affects Initial User Account Creation

CVE-2026-117618

What is CVE-2026-117618?

In certain versions of Jenkins, the HTTP endpoint responsible for creating the initial user account does not validate if the setup wizard is completed. This oversight allows unauthenticated attackers to exploit a race condition, potentially creating an administrator account while a new user account is in the process of being established. Proper assessment and remediation strategies are essential to safeguard against this unintentional access vulnerability.

References