Unrated severityNVD Advisory· Published Oct 28, 2026
CVE-2026-117613
CVE-2026-117613
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 2.587 and earlier, LTS 2.580.1 and earlier
Patches
Vulnerability mechanics
References
1News mentions
1- Jenkins Security Advisory 2026-10-28Jenkins Security Advisories · Oct 28, 2026