Unrated
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips...
CVE-2026-117623
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Original description The description as published by the source.
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web jenkins.io
- web nvd.nist.gov
- web github.com