Improper access control in Jenkins and Jenkins LTS - CVE-2026-117620
Published: November 2, 2026
Vulnerability identifier: #VU158587
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-117620
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to some of the code paths to report invalid data are not restricted to data being loaded from disk. A remote user can trigger a warning in the "Manage Old Data" feature to inject attacker-controlled data, leading to existing user account information override.
Affected software
Jenkins
Jenkins LTS
Jenkins LTS
How to mitigate CVE-2026-117620
Install updates from vendor's website.
Jenkins - update to 2.588
Jenkins LTS - update to 2.580.2
Jenkins LTS - update to 2.580.2