Jenkins published a core security advisory on Wednesday with 15 fixes. Several let someone with ordinary access, such as permission to read Jenkins or configure a job, end up running code on the controller, the server that holds your build secrets.
Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.
One needs no account at all, but only during the setup wizard. The fix for all of them is the same upgrade.
Fifteen Jenkins core fixes landed Wednesday. Several turn read or job-configure access into code running on the controller that holds your deploy keys.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Jenkins fixed 15 core flaws, several leading to code execution
The Jenkins Security Advisory 2026-10-28 covers Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier. Thirteen issues are rated High and two Medium. All are fixed in Jenkins 2.588 and LTS 2.580.2.
The most serious is CVE-2026-117612: the XStream converter did not apply Jenkins’ deserialization filter to classes named in the resolves-to attribute, so an attacker with Overall/Read and a user account could instantiate arbitrary types, “potentially leading to remote code execution.” CVE-2026-117614 lets users with Agent/Configure run code on the controller through unapproved legacy agent launch commands, and CVE-2026-117616 lets Overall/Read users load any config.xml on the controller as an agent and overwrite files when it is saved.
CVE-2026-117618 is a race in the setup wizard that lets an unauthenticated attacker create an administrator account while the initial account is being replaced. Many of the issues were reported through the Anthropic OSS program.
Build servers where many people can read or configure jobs
A Jenkins controller usually holds credentials for source control, cloud accounts and production deploys, so code running there reaches all of them. Overall/Read is often granted to every logged-in user, and in some setups to anonymous users too.
Two fixes affect access that outlives cleanup. CVE-2026-117619 let a revoked API token keep working through a “remember me” cookie, and CVE-2026-117620 let an Overall/Read user plant data in Manage Old Data that, once an admin acted on it, could reset another user’s password. The advisory does not report any of these issues being exploited.
Move to Jenkins 2.588 or LTS 2.580.2
- Upgrade weekly controllers to 2.588 and LTS controllers to 2.580.2.
- Check what anonymous and authenticated users can do under Manage Jenkins, then Security, and remove Overall/Read from anonymous if it is there.
- Finish the setup wizard before a new controller is reachable from any network you do not control.
- After upgrading, revoke API tokens you meant to retire and sign users out so old “remember me” cookies stop working.
Forward this
For whoever runs our Jenkins build servers: Jenkins fixed 15 security flaws on October 28, and several let users with basic access run code on the server that holds our deploy credentials. Can we upgrade to Jenkins 2.588 or LTS 2.580.2 this week and review who has read and configure access?
Details
- Code execution paths: CVE-2026-117612 (XStream
resolves-to), CVE-2026-117614 (legacy agent launch commands), CVE-2026-117615 (symlink followed when renaming an item, arbitrary file read), CVE-2026-117616 (agent name path traversal), CVE-2026-117617 (artifact extraction race, arbitrary file write). - Accounts and sessions: CVE-2026-117618 (setup wizard admin creation race, unauthenticated), CVE-2026-117619 (remember-me cookie outlives API token), CVE-2026-117620 (Manage Old Data account takeover).
- Escape hatch: if the new XStream type permissions break a plugin, the advisory documents the Java system property
hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION=true; use it only while you fix the plugin.
Hunt / verify
- Check the controller version in the footer of any Jenkins page or with
java -jar jenkins-cli.jar -s URL version. - Review the user list for administrator accounts created around the time a controller was set up, and agent configurations whose names or launch commands nobody remembers adding.
- Look in Manage Old Data for entries that reference user records.
Source: Jenkins Security Advisory 2026-10-28
Sources
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
