Vulnerability in Jenkins Project Jenkins

[ Description ]Official description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund28 Oct 2026WID-SEC-2026-4233

  Jenkins: Multiple vulnerabilities Translated from German

  CVE-2026-117621CVE-2026-117616CVE-2026-117622+12 more CVEs

[ References ]References

• www.jenkins.io/security/advisory/2026-10-28MitigationVendor Advisory