Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Newly rated high, disclosed Oct 28 Jenkins: file overwrite in agent loading endpoint (CVE-2026-117616) An attacker with basic read access can overwrite server config files, potentially enabling code execution. No patch listed yet https://cve.now/CVE-2026-117616?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
🚨High - Jenkins Agent Name Path Traversal via Unvalidated loadAgent (CVE-2026-117616) Jenkins exposes an HTTP endpoint that loads agents by name without validating the name. An attacker with Overall/Read can use path traversal in the agent name to load arbitrary controller config.xml as a node config, then overwrite arbitrary config.xml when saving the agent, potentially leading to RCE. Instances denying Overall/Read to untrusted users aren’t exposed. 👉Upgrade to Jenkins 2.588 or LTS 2.580.2.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jenkins | jenkins | - | - | - |
| App | jenkins | jenkins | - | - | - |