CVE-2026-117621 in Jenkins Plugin
Summary
by MITRE • 10/28/2026
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within Jenkins versions 2.587 and earlier, as well as Long Term Support releases up to version 2.580.1, specifically affecting the workspace browser functionality for remote agents. This vulnerability stems from an improper neutralization of special elements used in web pages, commonly categorized under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting. The core technical issue arises because Jenkins computes and renders URLs directly within the HTML response sent to the user interface without adequate sanitization or encoding when displaying links for files and directories located on remote agent workspaces. This architectural decision allows maliciously crafted file names or directory structures, controlled by an attacker who has compromised a build agent process, to inject executable JavaScript code into the rendered page context.
The operational impact of this vulnerability is significant because it enables cross-site scripting attacks that can be exploited by adversaries with control over any Jenkins agent connected to the master instance. In typical CI/CD pipelines, agents execute untrusted or semi-trusted build scripts and may handle artifacts from various sources. If an attacker gains access to such a process through other means, they can manipulate file names within the workspace directory structure. When a developer or administrator subsequently views the workspace browser in the Jenkins UI to inspect these files, the malicious content embedded in the URL computation is executed by their web browser. This execution occurs within the security context of the Jenkins application, allowing the attacker to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative changes, or redirecting users to phishing sites.
This vulnerability aligns with MITRE ATT&CK technique T1059: Command and Control, specifically sub-techniques involving web protocols for lateral movement or data exfiltration via browser-based attacks. It also relates to the broader category of supply chain compromise where control over a peripheral component like an agent is leveraged to impact the central management console. The risk is exacerbated by the fact that Jenkins administrators often have high privileges, and session hijacking can lead to full system compromise across all managed projects and pipelines.
Mitigation strategies primarily involve upgrading Jenkins to version 2.587 or later for standard releases, or LTS version 2.580.1 and above, where this input validation issue has been addressed through improved encoding of URL parameters in the workspace browser interface. Until an upgrade is feasible, administrators should restrict access to the Jenkins UI to trusted personnel only and ensure that agent processes are isolated with minimal privileges to reduce the likelihood of initial compromise. Additionally, implementing strict Content Security Policy headers can help mitigate some effects of XSS by restricting script execution sources, although this does not replace the need for patching the underlying vulnerability in the application logic. Regular auditing of plugin configurations and continuous monitoring for anomalous activity on agent nodes are also recommended to detect potential exploitation attempts early.