# CVE-2026-117613: Jenkins collection element type validation bypass

Source: https://junglewise.ai/threats/cve-2026-117613-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-117613 · Severity: info · Published 2026-10-28

Jenkins, an automation platform used to build and deploy software, deserializes configuration XML files submitted by users with job configuration permissions. An attacker with this permission can craft a malicious config.xml file to inject arbitrary data types into collections, leading to stored cross-site scripting attacks that persist in the system.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-117613 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117613 being exploited in the wild.

**How severe is CVE-2026-117613?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Jenkins 2.587 and earlier, LTS 2.580.1 and earlier.

**Is there a fix for CVE-2026-117613?** Yes: fixed in Jenkins 2.588, LTS 2.580.2. Until then: Administrators can disable the element type validation by setting the Java system property hudson.util.RobustReflectionConverter.skipFieldValueElementTypeCheck to true if validation causes operational issues. On Jenkins 2.539+ and LTS 2.541.1+, Content Security Policy provides partial mitigation against the XSS impact.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"},{"kind":"advisory","at":"2026-10-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117613 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-117613?** Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Jenkins 2.588, LTS 2.580.2

Administrators can disable the element type validation by setting the Java system property hudson.util.RobustReflectionConverter.skipFieldValueElementTypeCheck to true if validation causes operational issues. On Jenkins 2.539+ and LTS 2.541.1+, Content Security Policy provides partial mitigation against the XSS impact.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"},{"kind":"advisory","at":"2026-10-28"}]

## Technical details

XStream deserialization in Jenkins does not restrict collection element types during deserialization of XML configuration data. Attackers with Item/Configure permission can submit crafted job config.xml files that add unexpected element types to collections, resulting in stored XSS. Content Security Policy mitigates impact on Jenkins 2.539+ and LTS 2.541.1+; Jenkins 2.588 and LTS 2.580.2 add post-deserialization type validation.

## Affected products

- Jenkins Jenkins 2.587 and earlier, LTS 2.580.1 and earlier

## References

- [https://www.jenkins.io/security/advisory/2026-10-28/](https://www.jenkins.io/security/advisory/2026-10-28/)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)