---
id: CVE-2026-117614
title: >-
  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch
  commands in older agent configurations into launchers provided by the Command
  Agent Launcher Plugin without checking whether they have been approved by an
  administrat…
summary: >-
  Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch
  commands in older agent configurations into launchers provided by the Command
  Agent Launcher Plugin without checking whether they have been approved by an
  administrat…
severity: none
vendor: Jenkins Project
product: Jenkins
affected:
  - Jenkins (all versions)
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:48:30.245Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117614'
references:
  - url: 'https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4123'
    label: Jenkins Security Advisory 2026-10-28
tags:
  - cve.org
ingestedAt: '2026-10-28T17:14:44.454Z'
epss: 0.00398
epssPercentile: 0.34147
---

## Overview

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

## Affected

- `Jenkins (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.