Improper access control in Jenkins and Jenkins LTS - CVE-2026-117624
Published: November 2, 2026
Vulnerability identifier: #VU158588
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N]
CVE-ID: CVE-2026-117624
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected application does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values. A remote user can bypass the root element check and inject malicious nested objects.
Affected software
Jenkins
Jenkins LTS
Jenkins LTS
How to mitigate CVE-2026-117624
Install updates from vendor's website.
Jenkins - update to 2.588
Jenkins LTS - update to 2.580.2
Jenkins LTS - update to 2.580.2