Stored Cross-Site Scripting in Jenkins Breadcrumb Bar Overflow Menu

CVE-2026-117623

What is CVE-2026-117623?

The vulnerability in Jenkins arises from the application's failure to properly escape text in tooltips for breadcrumb bar overflow menu entries. As a result, attackers with Overall/Read permission can exploit this weakness to inject malicious scripts, leading to stored cross-site scripting attacks. This flaw could potentially allow unauthorized access to user data or session hijacking.

References