CVE-2026-117620
Description
A flaw was found in Jenkins. This vulnerability can lead to privilege escalation and account takeover by allowing an authenticated user with Overall/Read permission to trigger warnings in the Manage Old Data administrative feature. If an administrator acts on these warnings, attacker-controlled data is injected into the system, overwriting existing user account information and login passwords.
Statement
This vulnerability is rated with an Important severity because it enables authenticated users with minimal privileges to compromise administrative accounts, leading to a complete loss of integrity and confidentiality on the controller. In environments where Jenkins instances grant broad read access to authenticated users or internal teams, an attacker can manipulate configuration states to prompt administrative intervention. Although triggering the account overwrite requires administrator interaction through the management console, the resulting privilege escalation grants full control over the CI/CD pipeline infrastructure.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
