High · 8.8 CVE-2026-117612 EUVD-2026-112177GHSA-4xxv-wv5r-5fqc

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` att…

Published Oct 28, 2026 · Updated Nov 5, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Category: Web / CMS

Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins	—	—

Advisories 1

WID-SEC-2026-4233 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 28, 2026

References

Jenkins Security Advisory 2026-10-28 vendor-advisory