{"id":"CVE-2026-117624","title":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allow…","summary":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allow…","severity":"none","vendor":"Jenkins Project","product":"Jenkins","affected":["Jenkins (all versions)"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:48:36.029Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117624","references":[{"url":"https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4243","label":"Jenkins Security Advisory 2026-10-28"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.447Z","slug":"CVE-2026-117624","body":"## Overview\n\nJenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.\n\n## Affected\n\n- `Jenkins (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}