CVE-2026-117618

HighCVSS 8.1/10Last modified Nov 5, 2026

Description

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2026
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1176198.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API tokeCVE-2026-1176208.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old DataCVE-2026-1176216.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file anCVE-2026-1176226.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the cCVE-2026-1176235.4Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, rCVE-2026-1176248.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked asCVE-2026-1176254.3A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain theCVE-2026-1176264.3Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspCVE-2026-1176275.4A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider CVE-2026-117636.5Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software ServiceCVE-2026-1176356.5The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scopCVE-2026-117643.6When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating th
CVE-2026-117618: High severity, CVSS 8.1 | Vulnix