HTTP Basic Authentication Flaw in Jenkins by CloudBees

CVE-2026-117619

What is CVE-2026-117619?

A vulnerability exists in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, where requests authenticated via HTTP Basic authentication can exploit the system. An attacker who has obtained a user's API token can use it to gain unauthorized access through a 'remember me' cookie. This flaw allows the attacker to retain access even after the API token has been revoked or has expired, posing a significant security risk.

References