Vulnerability Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
References
FAQ
What is CVE-2026-117621?
CVE-2026-117621 is a documented vulnerability. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulne...
How severe is CVE-2026-117621?
CVSS scoring is not yet available for CVE-2026-117621. Check NVD for updates.
Is there a patch for CVE-2026-117621?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.