CVE-2026-117621

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

The record

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Affected packages

Ecosystem	Package	Introduced	Fixed