CVE-2026-117614 in Jenkins
Summary
by MITRE • 10/28/2026
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as CVE-2024-23897 represents a critical security flaw within the Jenkins continuous integration and delivery platform, specifically affecting versions 2.587 and earlier, as well as Long Term Support (LTS) releases up to version 2.580.1. This issue stems from an improper handling of agent configuration data during the process of converting legacy launch commands into modern launcher formats provided by the Command Agent Launcher Plugin. The core technical flaw lies in the absence of a mandatory administrative approval step for these converted configurations, which creates a direct path for privilege escalation and remote code execution within the Jenkins controller environment.
From a technical perspective, Jenkins agents are responsible for executing build tasks on behalf of the central controller. Historically, agent launch commands were defined directly in configuration files or through older plugin mechanisms. As Jenkins evolved to enhance security and standardize how agents connect, it introduced the Command Agent Launcher Plugin to manage these connections more securely. However, when migrating or updating configurations from older formats, the system automatically translates legacy command strings into new launcher objects without validating whether an administrator has explicitly approved this specific configuration change. This bypasses the intended security control that requires human intervention for significant infrastructure changes, effectively treating untrusted input as trusted executable code during the initialization phase of the agent connection process.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution in the context of the Jenkins controller Java Virtual Machine (JVM). An attacker who possesses Agent or Configure permissions on a Jenkins instance can craft a malicious configuration that, when processed by the vulnerable version, results in the execution of arbitrary system commands. Since these commands run with the privileges of the user account under which the Jenkins controller is operating, an attacker gains full control over the underlying host machine. This level of access allows for data exfiltration, installation of persistent backdoors, lateral movement within the network, and complete compromise of the CI/CD pipeline integrity. The severity is further amplified by the fact that Agent permissions are often granted to developers or automated systems, increasing the attack surface significantly compared to vulnerabilities requiring full administrator rights.
This vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately validate configuration data before processing it into executable commands. It also maps closely to ATT&CK technique T1496 Resource Hijacking and potentially T1053 Scheduled Task/Job if used for persistence, though its primary classification is related to privilege escalation via insecure deserialization or command injection patterns inherent in the launcher conversion logic. The lack of administrative oversight during this specific configuration migration path represents a significant deviation from the principle of least privilege and secure by design principles expected in enterprise-grade automation tools.
Mitigation strategies must focus on immediate version upgrades and strict access control reviews. Administrators should upgrade Jenkins to version 2.587 or later, where LTS users should move to version 2.580.2 or newer, as these releases include patches that enforce the necessary administrative approval workflows for agent launcher configurations. In environments where upgrading is not immediately feasible, restricting Agent and Configure permissions to only those individuals who strictly require them can reduce the risk of exploitation. Additionally, auditing existing agent configurations for any suspicious command strings and ensuring that all configuration changes are subject to a rigorous change management process involving explicit administrator sign-off can provide compensating controls against this specific attack vector until the software is updated.