High WID-SEC-2026-4233 15 CVEs

Jenkins: Mehrere Schwachstellen

Published Oct 28, 2026 · Updated Oct 28, 2026 · de-DE

Vendor: Jenkins Project Product: Jenkins Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um erweiterte Berechtigungen – einschließlich Administratorrechte – zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren sowie Cross-Site-Scripting-Angriffe durchzuführen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 15

High 8.8

CVE-2026-117612

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by t…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.8

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into laun…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.8

CVE-2026-117616

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validati…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.8

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.8

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objec…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.1

CVE-2026-117617

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only befo…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.1

CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not c…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
High 8.1

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, inclu…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 6.5

CVE-2026-117615

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being r…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 6.1

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace bro…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 6.1

CVE-2026-117622

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpRespon…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 5.4

CVE-2026-117613

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, a…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 5.4

CVE-2026-117623

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar ove…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 4.3

CVE-2026-117625

A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read per…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026
Medium 4.3

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the fi…

Jenkins Project Jenkins Web / CMS

Oct 28, 2026

Revision history

2026-10-28 #1
Initiale Fassung

References

Jenkins Security Advisory 2026-10-28 vom 2026-10-28
https://www.jenkins.io/security/advisory/2026-10-28/