CVE-2026-117619

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4189

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://www.jenkins.io/security/advisory/2026-10-28/

Full discourse1 post

mazino@devmoonpy1d
Jenkins' Oct 28 advisory: a stolen API token could obtain a persistent cookie that survives token revocation (CVE-2026-117619). Upgrade to 2.588 or LTS 2.580.2. Token revocation alone may not end an attacker's access. https://www.jenkins.io/security/advisory/2026-10-28/
0000021
128 followersView on X

Explore more

Back to dashboard