XStream type filter bypass
Overall/Read plus either a non-anonymous account or permission to POST config.xml permits unfiltered resolves-to classes during deserialization, potentially enabling code execution.
Jenkins fixes 15 core flaws including controller RCE and administrator account takeover
Jenkins fixes 15 core flaws in weekly 2.588 and LTS 2.580.2. Several paths can execute code on the controller; others affect accounts, sessions and browser rendering. Most require permissions or agent control; one targets the initial setup window. Exploitation is unconfirmed.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- Sharted
- 15 CVEs tracked here
- Splash zone
- Weekly ≤2.587 or LTS ≤2.580.1; permissions/agent control vary; an unauthenticated race targets initial setup
- jenkins
- In the wild
- Unknown
- The Jenkins advisory does not report in-the-wild exploitation.
What happened
Jenkins’s October 28 batch affects its widely deployed build controller, warranting L3. Weekly releases through 2.587 and LTS releases through 2.580.1 need the corresponding patched core. No victim count is supplied.
These are distinct attack paths, not one universal unauthenticated exploit. Most involve a readable controller plus additional permissions, control of an agent, or administrator interaction. The setup race instead requires reaching the short first-account replacement window. The individual entries above retain these distinctions.
The root-object issue has only been confirmed to create non-login user records. The file-browser issue exposes metadata, not arbitrary file contents. Neither should be described as full account takeover or unrestricted file read.
The vendor lists Content Security Policy enforcement as a mitigation for the collection, workspace-browser and breadcrumb XSS issues on weekly 2.539 / LTS 2.541.1 and newer. This does not cover the entire batch or replace the core upgrade. The advisory also documents compatibility switches that relax new checks; disabling protections is not remediation.
What’s in the bowl
Collection type confusion
Crafted job XML from a caller with Item/Configure can insert unexpected collection elements and cause stored XSS; other impacts may be possible.
Agent launch approval bypass
Agent/Configure permits execution in the controller JVM when legacy launch commands are migrated to the Command Agent Launcher Plugin without administrator approval.
Rename follows symbolic links
Item/Create together with Item/Configure permits controller file reads when a renamed item must be copied and contains symbolic links; this can lead to code execution.
Agent configuration path traversal
Overall/Read permits loading a controller config.xml as an agent; saving that agent can overwrite another config.xml and potentially execute code.
Artifact extraction race
Item/Configure permits concurrent artifact archiving to race symbolic-link checks and write outside the extraction directory on the controller, potentially enabling code execution.
First administrator creation race
With Jenkins’s own user database, an unauthenticated attacker can create an administrator during the brief setup-wizard interval between deletion of the initial user and creation of its replacement.
API token revocation bypass via cookies
A stolen API token can obtain a persistent remember-me cookie that continues granting access after the token is revoked or expires.
Old Data Monitor account overwrite
Overall/Read permits injecting an Old Data warning; administrator action on that warning can overwrite user data, including passwords when Jenkins uses its own user database.
Workspace browser agent-controlled XSS
Control of an agent process permits supplying malicious file links to the controller workspace browser, causing XSS.
Agent error response XSS
A controlled agent can send exceptions implementing Stapler HttpResponse that the controller renders as web responses, causing XSS.
Breadcrumb tooltip stored XSS
Overall/Read permits stored XSS through unescaped tooltip text in the breadcrumb overflow menu.
Nested persistence-root injection
A deserialization boundary bypass permits nested objects. Confirmed impact is new name/display-name records, not new accounts capable of logging in.
HTTP proxy configuration disclosure
Overall/Read permits reading the proxy server, port, username and no-proxy host list. The advisory does not list proxy passwords as exposed.
File browser metadata traversal
Overall/Read permits reading controller file names, sizes and modification times; Item/Workspace additionally exposes names of jobs sharing an agent workspace host.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Jenkins weekly | 2.588 | Patched |
| Jenkins LTS | 2.580.2 | Patched |
Crime-scene timeline
Oct 28, 2026
Core security batch disclosed and patched
The Jenkins advisory and both release changelogs announce weekly 2.588 and LTS 2.580.2.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Jenkins October 28 core security advisoryPrimaryFifteen core CVEs, distinct access prerequisites, fixes and compatibility caveats; no exploitation claim.
- Jenkins weekly changelogPrimaryWeekly 2.588 released October 28, 2026 with security fixes.
- Jenkins LTS changelogPrimaryLTS 2.580.2 released October 28, 2026 with security fixes.
- Jenkins CNA record: CVE-2026-117612PrimaryXStream type filter bypass.
- Jenkins CNA record: CVE-2026-117613PrimaryCollection type confusion.
- Jenkins CNA record: CVE-2026-117614PrimaryAgent launch approval bypass.
- Jenkins CNA record: CVE-2026-117615PrimaryRename follows symbolic links.
- Jenkins CNA record: CVE-2026-117616PrimaryAgent configuration path traversal.
- Jenkins CNA record: CVE-2026-117617PrimaryArtifact extraction race.
- Jenkins CNA record: CVE-2026-117618PrimaryFirst administrator creation race.
- Jenkins CNA record: CVE-2026-117619PrimaryAPI token revocation bypass via cookies.
- Jenkins CNA record: CVE-2026-117620PrimaryOld Data Monitor account overwrite.
- Jenkins CNA record: CVE-2026-117621PrimaryWorkspace browser agent-controlled XSS.
- Jenkins CNA record: CVE-2026-117622PrimaryAgent error response XSS.
- Jenkins CNA record: CVE-2026-117623PrimaryBreadcrumb tooltip stored XSS.
- Jenkins CNA record: CVE-2026-117624PrimaryNested persistence-root injection.
- Jenkins CNA record: CVE-2026-117625PrimaryHTTP proxy configuration disclosure.
- Jenkins CNA record: CVE-2026-117626PrimaryFile browser metadata traversal.
- Jenkins session and remember-me revocation advisoryPrimaryRenewing a user's seed through the configuration page invalidates sessions and remember-me cookies.
- Jenkins UserSeedProperty APIPrimaryThe user seed provides session revocation; disabling seed verification defeats that protection.