Jenkins Fixes 15 Vulnerabilities, Including Remote Code Execution Flaws

TL;DR

The Jenkins project has fixed 15 Jenkins vulnerabilities in its October 28, 2026 security advisory. Several of the flaws can lead to remote code execution on the Jenkins controller. Jenkins rated 13 of the issues High and two Medium.

Attackers with low-level permissions could run code, read or write files, or take over admin accounts. One race condition even lets unauthenticated attackers create an admin account during setup. Upgrade to Jenkins 2.588 or LTS 2.580.2 now.

Notable CVEs

Why It Matters

Jenkins controllers hold build secrets, credentials and pipeline code. As a result, remote code execution on a controller can expose the whole software supply chain. Many of these bugs need only Overall/Read permission, a low bar for an attacker who already has a basic account.

Notably, Anthropic’s OSS program reported or co-reported 13 of the 15 issues. Two more came through the Jenkins Bug Bounty Program sponsored by the European Commission.

Severity

Based on the CVSS 3.1 vectors in the advisory, the RCE, file access and agent path traversal Jenkins vulnerabilities score 8.8. The setup wizard race scores 8.1, since it needs precise timing. The two Medium issues score 4.3.

How the Attack Works

Deserialization and RCE flaws

CVE-2026-117612 targets XStream deserialization. According to the advisory, the converter “does not apply the deserialization filter to classes referenced by the resolves-to attribute.” This “allows attackers to instantiate arbitrary types during deserialization, potentially leading to remote code execution.”

Similarly, CVE-2026-117614 bypasses launch command approval for older agent configurations. The advisory warns this lets users with Agent/Configure permission “execute arbitrary code in the context of the Jenkins controller JVM.”

File read and write flaws

Other bugs abuse the controller file system. CVE-2026-117615 follows symbolic links when copying a renamed item, which allows arbitrary file reads. CVE-2026-117616 is a path traversal in agent names that can overwrite config.xml files. Meanwhile, CVE-2026-117617 is a race condition in artifact extraction that can write files anywhere on the controller.

Account takeover flaws

CVE-2026-117618 abuses the setup wizard. The advisory explains that a race condition “allows unauthenticated attackers to create an administrator account while the initial account is being replaced.” In addition, CVE-2026-117620 plants a warning in the “Manage Old Data” feature. If an admin acts on it, the attacker can override another user’s password. CVE-2026-117619 lets a stolen API token keep working after revocation through a “remember me” cookie.

XSS and information leaks

Four flaws are cross-site scripting bugs, including two that a compromised agent could trigger. Finally, two Medium issues expose HTTP proxy settings and file names in JENKINS_HOME.

Affected Versions

• Jenkins weekly 2.587 and earlier
• Jenkins LTS 2.580.1 and earlier

Patch and Mitigation

Upgrade to Jenkins 2.588 or LTS 2.580.2. These releases also add XStream type permissions and stricter collection type checks. If they cause problems, the advisory lists Java system properties that can disable each new check.

Until you patch, review who holds Overall/Read and Configure permissions. Also, enforce Content Security Policy protection. The advisory says it mitigates several of the XSS issues on Jenkins 2.539 and LTS 2.541.1 or newer.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.