Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Jenkins |
|
| Jenkins Project |
|
No data.
No data.
References
History
Wed, 28 Oct 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Jenkins
Jenkins jenkins Jenkins Project Jenkins Project jenkins |
|
| Vendors & Products |
Jenkins
Jenkins jenkins Jenkins Project Jenkins Project jenkins |
Wed, 28 Oct 2026 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Arbitrary Agent Configuration Overwrite Enables Remote Code Execution in Jenkins | |
| Weaknesses | CWE-20 CWE-284 CWE-73 |
Wed, 28 Oct 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: jenkins
Published: 2026-10-28T16:48:31.398Z
Updated: 2026-10-28T16:48:31.398Z
Reserved: 2026-10-27T13:10:56.914Z
Link: CVE-2026-117616
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T17:18:20.937
Modified: 2026-10-28T17:18:20.937
Link: CVE-2026-117616
Redhat
No data.