Vulnerability Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.
References
FAQ
What is CVE-2026-117616?
CVE-2026-117616 is a documented vulnerability. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.x...
How severe is CVE-2026-117616?
CVSS scoring is not yet available for CVE-2026-117616. Check NVD for updates.
Is there a patch for CVE-2026-117616?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.