–
Not scored
CVE-2026-117624
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level…
JenkinsAffectedJenkins
FixUpdate to 2.588, 2.580.2 or newer
PublishedOct 28, 16:48 · jenkins
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.
From jenkins
Affected and fixed versions
ProductAffectedFixed inJenkinsNot affected2.588JenkinsNot affected2.580.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known