First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-117616

HighCVSS 8.8/10Last modified Nov 9, 2026

Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins	—

References

https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4188Mitigation, Vendor Advisory

Timeline

Published: Oct 28, 2026
Last modified: Nov 9, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1176178.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its paren CVE-2026-1176188.1In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu CVE-2026-1176198.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke CVE-2026-1176208.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data CVE-2026-1176216.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file an CVE-2026-1176226.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the c CVE-2026-1176235.4Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, r CVE-2026-1176248.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as CVE-2026-1176254.3A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the CVE-2026-1176264.3Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for worksp CVE-2026-1176275.4A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider CVE-2026-117636.5Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Service

CVE-2026-117616: High severity, CVSS 8.8 | Vulnix