CVE-2026-117619 in Jenkins
Summary
by MITRE • 10/28/2026
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Jenkins versions 2.587 and earlier, as well as LTS version 2.580.1 and earlier, represents a significant authentication bypass flaw centered on the improper handling of session persistence mechanisms when combined with HTTP Basic Authentication. This issue specifically affects scenarios where users or automated systems authenticate using an API token via the standard HTTP Basic Auth header. Under normal security expectations, revoking an API token should immediately invalidate all associated access rights and sessions. However, due to a flaw in how Jenkins processes authentication requests for persistent session cookies, attackers who have acquired a valid user's API token can exploit this behavior to obtain a "remember me" cookie even after the token has been revoked or expired by the administrator.
From a technical perspective, the root cause lies in the interaction between the HTTP Basic Authentication filter and the Remember Me authentication mechanism within Jenkins' security architecture. When an authenticated request is made using valid credentials, including API tokens which are treated as equivalent to passwords for basic auth purposes, the server generates session data that includes persistent cookies designed to maintain login state across browser sessions or long-running processes. The vulnerability arises because this cookie generation process does not sufficiently validate whether the underlying credential used for authentication remains active and authorized at the time of cookie issuance. Consequently, if an attacker intercepts a request made with a valid API token before it is revoked, they can capture the resulting "remember me" cookie. Even after the administrator revokes that specific API token to prevent further direct access via basic auth headers, the captured persistent session remains valid because Jenkins continues to recognize and trust the stored session identifier associated with that user account.
The operational impact of this vulnerability is severe for organizations relying on Jenkins for continuous integration and deployment pipelines. An attacker possessing a stolen or leaked API token can maintain unauthorized persistence within the CI/CD environment long after remediation efforts have been initiated by security teams. This undermines the effectiveness of standard incident response procedures that rely on credential revocation as an immediate containment strategy. The persistent access allows attackers to execute arbitrary code, modify build configurations, steal sensitive artifacts, or pivot further into internal networks connected via Jenkins agents. Since API tokens are often used in automated scripts and pipelines with elevated privileges, this persistence can lead to widespread compromise of the software supply chain.
This vulnerability aligns with CWE-613, which describes insufficient session expiration, as well as CWE-287, involving improper authentication mechanisms where credentials do not properly invalidate associated sessions. In terms of MITRE ATT&CK framework mapping, this behavior facilitates Persistence through valid accounts and potentially Initial Access if the token was obtained via phishing or credential stuffing. The ability to retain access after revocation is a critical failure in identity lifecycle management.
To mitigate this risk, organizations running affected Jenkins versions must upgrade immediately to version 2.587 LTS or later for long-term support releases, or version 2.587 and above for the weekly release line. This update includes fixes that ensure session cookies are not issued or remain valid when authenticated via revoked API tokens. Additionally, administrators should enforce strict rotation policies for all API tokens and consider implementing additional layers of authentication such as two-factor authentication where supported by plugins. Monitoring logs for unusual patterns in "remember me" cookie usage can also help detect exploitation attempts before significant damage occurs.