Jenkins Core Vulnerabilities Allow RCE, XSS, and Arbitrary File Access
Jenkins has issued a critical security advisory detailing six high-severity vulnerabilities in its core product, including remote code execution and cross-site scripting flaws.
Jenkins, a widely-used open-source automation server, has released a significant security advisory addressing six high-severity vulnerabilities that impact its core functionality. These flaws, detailed in advisory JEN-2026-10-28, could allow attackers to achieve remote code execution (RCE), conduct cross-site scripting (XSS) attacks, and gain unauthorized access to arbitrary files on the Jenkins controller.
The most critical of these vulnerabilities, CVE-2026-117612 (SECURITY-4125), is an RCE flaw stemming from improper handling of the resolves-to attribute during XStream deserialization. Jenkins utilizes XStream for serializing and deserializing configuration and build data. While Jenkins employs a custom deserialization filter to mitigate common deserialization risks, this particular vulnerability allowed attackers with Overall/Read permission and a user account, or specific configuration permissions, to instantiate arbitrary types. This could lead to the execution of malicious code on the Jenkins controller. The fixed versions, Jenkins 2.588 and LTS 2.580.2, now apply the deserialization filter to classes referenced by the resolves-to attribute and leverage the XStream type permissions system.
Another significant vulnerability, CVE-2026-117613 (SECURITY-4225), is a stored XSS flaw caused by a bypass of collection element type checks during XStream deserialization. Attackers with Item/Configure permission could submit a crafted job configuration file that would trigger this vulnerability, leading to the execution of arbitrary scripts within the context of a user's browser. The updated Jenkins 2.588 and LTS 2.580.2 versions include a post-processing step to validate collection element types after deserialization, mitigating this risk.
Several other vulnerabilities expose Jenkins controllers to unauthorized access and code execution. CVE-2026-117614 (SECURITY-4123) allows attackers with Agent/Configure permission to execute arbitrary code by bypassing agent launch command approval. This was possible due to Jenkins converting older agent configurations into launchers provided by the Command Agent Launcher Plugin without proper approval checks. The patched versions no longer perform this conversion for older configurations.
Furthermore, CVE-2026-117615 (SECURITY-4187) is a link-following vulnerability that enables arbitrary file reads. When renaming an item, Jenkins would follow symbolic links during directory copying. Attackers with Item/Create and Item/Configure permissions could exploit this to read sensitive files on the Jenkins controller, potentially leading to RCE. The fix in Jenkins 2.588 and LTS 2.580.2 prevents the copying of directories containing symbolic links.
CVE-2026-117616 (SECURITY-4188) is a path traversal vulnerability in agent names. Previously, Jenkins allowed loading agents by name via HTTP requests without proper validation, enabling attackers with Overall/Read permission to load arbitrary config.xml files as agent configurations. This could lead to overwriting existing configurations or even arbitrary code execution. The updated versions now validate agent names and reject mismatched configurations.
Finally, CVE-2026-117617 (SECURITY-4248) is a race condition in artifact extraction that allows arbitrary file creation. Jenkins previously had a flaw in its symbolic link checks during artifact extraction, allowing attackers with Item/Configure permission to replace existing files or directories with symbolic links, leading to arbitrary file creation. The advisory indicates that this vulnerability is being addressed, though the specific fix details for this particular CVE were not fully elaborated in the provided text, beyond stating the general area of the vulnerability.
Users of Jenkins are strongly advised to update to the patched versions, Jenkins 2.588 or LTS 2.580.2, as soon as possible to protect their environments from these critical security threats. The vulnerabilities affect a wide range of Jenkins installations, underscoring the importance of prompt patching for CI/CD infrastructure.