Cross-Site Scripting Vulnerability in Jenkins by CloudBees

CVE-2026-117621

What is CVE-2026-117621?

A cross-site scripting vulnerability in Jenkins versions 2.587 and earlier, including LTS versions 2.580.1 and earlier, allows attackers to manipulate the URL generated for files and directories in the workspace browser. This flaw can be exploited by malicious actors with control over agent processes, potentially leading to unauthorized access or data exposure. It is crucial for users to update their Jenkins installations to mitigate the risks associated with this vulnerability.

References