Missing Permission Checks in Jenkins Affecting Server Configuration Exposure

CVE-2026-117625

What is CVE-2026-117625?

A vulnerability in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, arises from a missing permission check. This oversight permits attackers with Overall/Read permission to gain unauthorized access to sensitive information, including the server, port, user name, and no-proxy host list of the configured HTTP proxy. Organizations using affected versions should review their configurations and update their systems to mitigate this risk.

References