Vulnerability Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.
References
FAQ
What is CVE-2026-117620?
CVE-2026-117620 is a documented vulnerability. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject a...
How severe is CVE-2026-117620?
CVSS scoring is not yet available for CVE-2026-117620. Check NVD for updates.
Is there a patch for CVE-2026-117620?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.