Cross-Site Scripting Vulnerability in Jenkins by Jenkins Project
CVE-2026-117622

Currently unrated

Key Information:

Vendor

Jenkins
Status
Jenkins
Vendor
CVE Published:
28 October 2026

What is CVE-2026-117622?

A vulnerability in Jenkins allows agents to send crafted exceptions implementing the Stapler HttpResponse interface back to the controller. This can be exploited by attackers who control the agent processes, leading to potential execution of malicious scripts in users' browsers. Proper measures should be taken to patch affected versions and secure the Jenkins environment.

Affected Version(s)

Jenkins 2.588

Jenkins 2.588

Jenkins 2.580.2 < 2.580.*

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECU...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.