CVE-2026-27099

The record

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

Affected packages

Related vulnerabilities

• GHSA-85h6-5m3v-gx37 Jenkins has a stored XSS vulnerability in node offline cause description Same vulnerability
• GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter Also affects org.jenkins-ci.main:jenkins-core
• CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that… Also affects org.jenkins-ci.main:jenkins-core
• GHSA-6837-qgrc-x5p6 Jenkins has a CSRF vulnerability on the login form Also affects org.jenkins-ci.main:jenkins-core
• GHSA-9p56-p6mw-w8qc Jenkins has a Denial of service vulnerability in HTTP-based CLI Also affects org.jenkins-ci.main:jenkins-core
• GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
• GHSA-hxjg-2jvf-h3rx Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
• GHSA-p3f5-98cv-562j Jenkins is missing a permission check on password fields Also affects org.jenkins-ci.main:jenkins-core