Jenkins core: 15 vulnerabilities including XStream deserialization RCE and a setup-wizard admin takeover race (Jenkins 2.588, LTS 2.580.2)

The Jenkins project published a core security advisory on Oct 28 fixing 15 vulnerabilities in Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier, 13 rated High and 2 Medium. The most serious: CVE-2026-117612 lets attackers with Overall/Read and a user account (or any config.xml POST permission) instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution. CVE-2026-117614 lets users with Agent/Configure run arbitrary code on the controller through unapproved legacy agent launch commands. CVE-2026-117615, CVE-2026-117616 and CVE-2026-117617 allow arbitrary file read, config.xml overwrite and arbitrary file writes on the controller that can lead to code execution. CVE-2026-117618 is a race in the setup wizard that lets unauthenticated attackers create an administrator account while the initial account is being replaced, and CVE-2026-117620 lets Overall/Read users take over accounts through the Manage Old Data feature. The rest are stored XSS, a remember-me cookie that survives API token revocation, and information leaks. All are fixed in Jenkins 2.588 and LTS 2.580.2. Many were reported by the Anthropic OSS program.

Why this severity: 13 of 15 issues rated High by the Jenkins project, 2 Medium; most need Overall/Read or a configure permission, but CVE-2026-117618 is unauthenticated during initial setup; no exploitation reported

Started

Oct 28, 2026

CVEs

CVE-2026-117612CVE-2026-117613CVE-2026-117614CVE-2026-117615CVE-2026-117616CVE-2026-117617CVE-2026-117618CVE-2026-117619CVE-2026-117620CVE-2026-117621CVE-2026-117622CVE-2026-117623CVE-2026-117624CVE-2026-117625CVE-2026-117626

• Java
• Dev tools & CI
• #Jenkins
• #CI/CD
• #Deserialization
• #Xstream
• RCE
• #Path Traversal
• #XSS
• #Privilege escalation

Notes & caveats

Jenkins credits the Anthropic OSS program for most of the issues, plus Jongyeon Lee (2jo), Bilishee (Xmirror Security Team) and Samy Medjahed (Ap4sh). New hardening in 2.588 and 2.580.2 can be relaxed with Java system properties if it breaks existing configs: hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION and the hudson.util.RobustReflectionConverter.* properties listed in the advisory.