UNKNOWN NVD

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their confi

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4243

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This unknown severity vulnerability was published on 2026-10-28 via NVD.

vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.