Jenkins
Jenkins Security Advisory 2026-10-28
2026-10-28 Oct 28, 2026 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2026-10-28/. 15 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2026-10-28/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
16 lines
Showing 1–16 of 16
CVE-2026-117615
BR2026-0000-037529
SECURITY-4187
unclaimed
Link following vulnerability allows arbitrary file read
Credited as Anthropic OSS program
CVE-2026-117616
BR2026-0000-037530
SECURITY-4188
unclaimed
Path traversal vulnerability in agent names
Credited as Anthropic OSS program
CVE-2026-117619
BR2026-0000-037531
SECURITY-4189
unclaimed
Insufficient session expiration vulnerability
Credited as Anthropic OSS program
CVE-2026-117625
BR2026-0000-037532
SECURITY-4206
unclaimed
Missing permission check allows obtaining HTTP proxy configuration
Credited as Anthropic OSS program
CVE-2026-117613
BR2026-0000-037533
SECURITY-4225
unclaimed
Collection element type check bypass vulnerability
Credited as Anthropic OSS program
CVE-2026-117620
BR2026-0000-037534
SECURITY-4226
unclaimed
Old Data Monitor injection lets users take over administrator accounts
Credited as Anthropic OSS program
CVE-2026-117623
BR2026-0000-037535
SECURITY-4229
unclaimed
Stored XSS vulnerability in breadcrumb bar overflow menu
Credited as Anthropic OSS program
CVE-2026-117621
BR2026-0000-037536
SECURITY-4232
unclaimed
XSS vulnerability in workspace browser
Credited as Anthropic OSS program
CVE-2026-117626
BR2026-0000-037537
SECURITY-4237
unclaimed
Path traversal vulnerability in file browser
Credited as Anthropic OSS program
CVE-2026-117624
BR2026-0000-037538
SECURITY-4243
unclaimed
Root element restriction bypass in XStream deserialization
Credited as Anthropic OSS program; and, independently, tracenull
CVE-2026-117624
BR2026-0000-037539
SECURITY-4243
unclaimed
Root element restriction bypass in XStream deserialization
Credited as Opr4 (GitHub: Opr4Mp3r)
CVE-2026-117612
BR2026-0000-037540
SECURITY-4125
unclaimed
RCE vulnerability in XStream deserialization due to improper `resolves-to` attribute handling
Credited as Bilishee from the Xmirror Security Team; and, independently, Anthropic OSS program
CVE-2026-117618
BR2026-0000-037541
SECURITY-4122
unclaimed
Race condition in setup wizard allows creating an administrator account
Credited as Jongyeon Lee (2jo); and, independently, Anthropic OSS program
CVE-2026-117614
BR2026-0000-037542
SECURITY-4123
unclaimed
Agent launch command approval bypass vulnerability
Credited as Jongyeon Lee (2jo); and, independently, Anthropic OSS program
CVE-2026-117617
BR2026-0000-037543
SECURITY-4248
unclaimed
Race condition in artifact extraction allows arbitrary file creation
Credited as Samy Medjahed (Ap4sh)
CVE-2026-117622
BR2026-0000-037544
SECURITY-4249
unclaimed
XSS vulnerability in handling of agent errors
Credited as Samy Medjahed (Ap4sh)