CVE-2026-117621

high

Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4232

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112186

Details

Source: Mitre, NVD

Published: 2026-10-28

Updated: 2026-10-29

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.0018