CVEsJenkins ProjectCVE-2026-117623Published Oct 28, 16:48 · Updated Oct 28, 16:48 UTC

–

Not scored

CVE-2026-117623

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS)…

Jenkins

AffectedJenkins

FixUpdate to 2.588, 2.580.2 or newer

PublishedOct 28, 16:48 · jenkins

ScoredNot yet

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:08 UTC

What we know

No known exploitation. CISA KEV, checked 22:08 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

No severity score yet.

Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

From jenkins

Affected and fixed versions

ProductAffectedFixed inJenkinsNot affected2.588JenkinsNot affected2.580.2

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

Jenkins Security Advisory 2026-10-28 · jenkins.iovendor advisory

Other CVEs in Jenkins

All 151 →

–Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and… · CVE-2026-117626Oct 28 –A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port,… · CVE-2026-117625Oct 28 –Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their… · CVE-2026-117624Oct 28