Data Injection Vulnerability in Jenkins Software by Jenkins

CVE-2026-117620

What is CVE-2026-117620?

Jenkins versions 2.587 and earlier, along with LTS version 2.580.1 and earlier, expose a significant vulnerability that allows attackers possessing Overall/Read permissions to exploit the 'Manage Old Data' feature. By triggering warnings associated with this feature, attackers can inject data of their choosing, leading to alterations in existing user account details, including login credentials. This could potentially enable unauthorized access or manipulation of user accounts, presenting a critical security risk for Jenkins installations.

References