Is CVE-2026-117613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117613 being exploited in the wild.

How severe is CVE-2026-117613?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier.

How is CVE-2026-117613 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-117613?

Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117613: Jenkins collection element type validation bypass

CVE-2026-117613 · Severity: info · Published 2026-10-28

Jenkins, an automation platform used to build and deploy software, deserializes configuration XML files submitted by users with job configuration permissions. An attacker with this permission can craft a malicious config.xml file to inject arbitrary data types into collections, leading to stored cross-site scripting attacks that persist in the system.

Technologies: Jenkins. Vendors: Jenkins.

Quick answers

Is CVE-2026-117613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117613 being exploited in the wild.
How severe is CVE-2026-117613?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier.
Is there a fix for CVE-2026-117613?: Yes: fixed in Jenkins 2.588, LTS 2.580.2. Until then: Administrators can disable the element type validation by setting the Java system property hudson.util.RobustReflectionConverter.skipFieldValueElementTypeCheck to true if validation causes operational issues. On Jenkins 2.539+ and LTS 2.541.1+, Content Security Policy provides partial mitigation against the XSS impact.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"},{"kind":"advisory","at":"2026-10-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-117613 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-117613?: Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Jenkins 2.588, LTS 2.580.2

Administrators can disable the element type validation by setting the Java system property hudson.util.RobustReflectionConverter.skipFieldValueElementTypeCheck to true if validation causes operational issues. On Jenkins 2.539+ and LTS 2.541.1+, Content Security Policy provides partial mitigation against the XSS impact.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"},{"kind":"advisory","at":"2026-10-28"}]

Technical details

XStream deserialization in Jenkins does not restrict collection element types during deserialization of XML configuration data. Attackers with Item/Configure permission can submit crafted job config.xml files that add unexpected element types to collections, resulting in stored XSS. Content Security Policy mitigates impact on Jenkins 2.539+ and LTS 2.541.1+; Jenkins 2.588 and LTS 2.580.2 add post-deserialization type validation.

Affected products

Jenkins Jenkins 2.587 and earlier, LTS 2.580.1 and earlier

References

https://www.jenkins.io/security/advisory/2026-10-28/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.