2026-11-03
Jenkins 2.588 and LTS 2.580.2 fix 15 flaws (CVE-2026-117612 to 117626): check your version and what to review after updating
On October 28, 2026 the Jenkins project published a security advisory fixing 15 vulnerabilities in Jenkins core (CVE-2026-117612 to CVE-2026-117626) in weekly 2.588 and LTS 2.580.2. Affected are weekly 2.587 and earlier and LTS 2.580.1 and earlier. The advisory rates 13 as High and 2 as Medium. Most need some permission such as Overall/Read or Item/Configure (some setups grant Overall/Read to anonymous users). The exception is CVE-2026-117618, a race condition in the setup wizard that lets an unauthenticated user create an administrator account during initial setup, which raises the priority for newly installed Jenkins instances exposed to the internet. The only workarounds the advisory lists are settings to switch off new checks if the update causes problems, and enforced Content Security Policy, which limits the known impact of three XSS issues; updating is the fix. This site found no credible report of exploitation as of November 3, and none of the 15 is in CISA's Known Exploited Vulnerabilities (KEV) catalog. This site's conclusion: confirm your Jenkins version, update to 2.588 (LTS 2.580.2), keep Jenkins off the internet and anonymous users without permissions, and review users, administrators and agents after updating.