CVE-2026-117623

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

Published

2026-10-28

Modified

2026-10-28

Record from

the NVD, synced 2026-10-28

References

• https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4229

Check your stackJSON