Jenkins 2.588 and LTS 2.580.2 fix 15 core flaws, including XStream code execution

Jenkins 2.588 and LTS 2.580.2 fix 15 core flaws, including XStream code execution

28 October 2026: The Jenkins project published a security advisory on 28 October covering 15 vulnerabilities in Jenkins core, 13 rated high and 2 medium (CVE-2026-117612 to CVE-2026-117626). Every weekly release up to 2.587 and every LTS release up to 2.580.1 is affected. The fixes are in Jenkins 2.588 and LTS 2.580.2. The advisory covers core only, so plugins need their own checks.

The flaws that lead to code execution or takeover

• XStream deserialization (SECURITY-4125, CVE-2026-117612): a custom converter did not apply Jenkins' class filter to classes named in a resolves-to attribute. Anyone with Overall/Read and a permission that can post config.xml, such as Item/Configure, View/Configure or Agent/Configure, can execute code. The fix also adds XStream type permissions, which can be switched off with a system property if it breaks something.
• Setup wizard race (SECURITY-4122, CVE-2026-117618): while the initial account is being replaced during setup, an endpoint meant to stop administrators locking themselves out lets an unauthenticated attacker create an administrator account. New installations exposed to a network during setup are the ones at risk.
• Agent launchers without approval (SECURITY-4123, CVE-2026-117614): old agent configurations are converted into Command Agent Launcher Plugin launchers without administrator approval, so Agent/Configure is enough to run code on the controller.
• Old Data Monitor injection (SECURITY-4226, CVE-2026-117620): a user with Overall/Read can plant a warning that, when an administrator acts on it, overwrites a user account's data, including the password on controllers using Jenkins' own user database.
• Files and paths (SECURITY-4187, 4188 and 4248): renaming an item follows symlinks and can expose arbitrary controller files; path traversal in agent names lets Overall/Read load any config.xml as an agent and overwrite files; and a race in artifact extraction from parallel Pipeline branches writes arbitrary files. The last was reported through the Jenkins bug bounty programme sponsored by the European Commission.

The rest of the list

Other high-rated issues include stored cross-site scripting in the workspace browser, agent error messages and breadcrumb tooltips (mitigated where Content Security Policy is enforced, on 2.539 and LTS 2.541.1 or later), a stored XSS through collection type checks, a root-element bypass in XStream whose confirmed impact is limited to creating user records, and "remember me" cookies that can be obtained with an API token and outlive its revocation (SECURITY-4189). The two medium issues expose the HTTP proxy configuration and file names in $JENKINS_HOME to users with Overall/Read.

Who should move first

Many of these need some permission, but in Jenkins Overall/Read is often granted to every signed-in user, and Item/Configure to every developer. Controllers where many people can configure jobs or agents carry the most exposure, as do controllers reachable from the internet. The project does not report exploitation in the wild. After upgrading, administrators should check whether the new XStream type permissions break any plugin before reaching for the opt-out, and review API tokens that were revoked recently, since "remember me" cookies obtained with them stay valid until the upgrade.

Related on TrustList:

• Alpine rebuilds GitLab after CVE-2026-97229 attempt; the fix needs patched Ruby
• Gheist campaign uses stolen GitHub tokens to dump Actions secrets
• PingCAP breach: TiDB Cloud users told to replace API keys now

Sources

• Jenkins Security Advisory 2026-10-28, 28 October 2026