–
Not scored
CVE-2026-117620
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject…
JenkinsAffectedJenkins
FixUpdate to 2.588, 2.580.2 or newer
PublishedOct 28, 16:48 · jenkins
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.
From jenkins
Affected and fixed versions
ProductAffectedFixed inJenkinsNot affected2.588JenkinsNot affected2.580.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known