{"id":"CVE-2026-117619","title":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a \"remember me\" cookie, allowing attackers who have obtained a user's API token to r…","summary":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a \"remember me\" cookie, allowing attackers who have obtained a user's API token to r…","severity":"none","vendor":"Jenkins Project","product":"Jenkins","affected":["Jenkins (all versions)"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:48:33.134Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117619","references":[{"url":"https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4189","label":"Jenkins Security Advisory 2026-10-28"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.451Z","slug":"CVE-2026-117619","body":"## Overview\n\nJenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a \"remember me\" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a \"remember me\" cookie after the API token is revoked or expires.\n\n## Affected\n\n- `Jenkins (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}