Deserialization Vulnerability in Jenkins Software by Jenkins

CVE-2026-117624

What is CVE-2026-117624?

Jenkins versions up to 2.587 and LTS version up to 2.580.1 allow attackers to exploit a weakness in how the application handles deserialization of certain objects. This inconsistency enables the potential bypass of root element checks, resulting in the injection of nested objects, which can compromise the system's integrity. Proper enforcement of object deserialization rules is essential to safeguard against such vulnerabilities.

References