CVE-2026-117623 in Jenkins
Summary
by MITRE • 10/28/2026
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within Jenkins versions 2.587 and earlier, as well as Long Term Support releases up to version 2.580.1. This vulnerability is classified as a stored cross-site scripting issue that specifically affects the rendering of tooltips associated with breadcrumb bar overflow menu entries. The core technical deficiency lies in the failure to properly escape user-supplied text before it is rendered within these tooltip elements. In web application security, proper output encoding is critical when displaying data derived from external sources or administrative configurations back into the browser environment. When this escaping mechanism is absent, malicious scripts embedded within the stored content are executed by the victim's web browser upon interaction with the affected interface element.
The operational impact of this vulnerability allows attackers possessing Overall/Read permissions to inject and execute arbitrary JavaScript code in the context of other users' sessions. The requirement for Overall/Read permission indicates that while a full administrative compromise is not necessary, an attacker must have at least read access to the Jenkins instance or specific projects within it. This threshold is relatively low compared to critical administration roles, thereby increasing the attack surface significantly. Once triggered, typically by hovering over or interacting with the breadcrumb bar overflow menu where the malicious content has been stored, the injected script runs with the privileges of the viewing user. This can lead to session hijacking, credential theft via keyloggers, unauthorized actions performed on behalf of the victim, or redirection to phishing sites designed to compromise further credentials.
From a classification perspective, this vulnerability aligns directly with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored XSS because the malicious payload is saved on the server side and subsequently served to multiple users when they access the affected page or component. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1059, Command and Control via Web Protocols, specifically under sub-techniques involving browser-based execution such as JavaScript. Attackers leverage these stored scripts to establish persistent footholds within the organization's infrastructure without needing direct shell access initially.
Mitigation strategies must prioritize immediate patching of Jenkins instances to versions 2.587.1 and LTS 2.580.2 or later, where this input validation issue has been resolved by implementing robust output encoding for all breadcrumb tooltip content. For environments unable to upgrade immediately due to compatibility constraints, administrators should enforce strict Content Security Policy headers that restrict the execution of inline scripts within the Jenkins web interface. Additionally, restricting Overall/Read permissions to only essential personnel can reduce the likelihood of an attacker successfully injecting payloads into accessible components. Regular auditing of user roles and permission assignments is recommended to ensure adherence to the principle of least privilege, thereby limiting the potential impact should a vulnerability in another component be exploited.