CVE-2026-117614
Description
A flaw was found in Jenkins. When converting legacy agent configurations into modern launcher commands, the system fails to verify whether the commands were approved by an administrator. An authenticated user with agent configuration permissions can exploit this flaw to execute arbitrary code on the Jenkins controller within the Java Virtual Machine (JVM) environment.
Statement
This vulnerability is rated as Important rather than Critical because successful exploitation requires an authenticated account holding specialized Agent/Configure privileges rather than being accessible to anonymous users. In Red Hat environments utilizing Jenkins, such as OpenShift Container Platform continuous integration deployments, agent configuration permissions are typically restricted to administrative personnel, substantially reducing exposure during standard operations. If granted these permissions, a compromised or malicious user can bypass administrative approval checks during legacy build node launcher transitions, resulting in arbitrary code execution within the controller process and complete takeover of the CI/CD pipeline.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
