CVSS 6.1 (medium) · published 2026-10-28
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
Affected products (NVD): jenkins jenkins
Fixed in (NVD): 2.580.2, 2.588
Weakness: CWE-79
Source: NVD CVE-2026-117622
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.