CVE-2026-117624

— UNSCORED

Published 2026-10-28 · Updated 2026-10-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.

All references

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4243

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.