# CVE-2026-117616: Jenkins path traversal in agent name loading

Source: https://junglewise.ai/threats/cve-2026-117616-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-provides-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-117616 · Severity: info · Published 2026-10-28

Jenkins is an automation server used to build, test, and deploy software. An attacker with read permissions can exploit an unvalidated agent-loading endpoint to read or overwrite arbitrary configuration files on the Jenkins controller, potentially leading to code execution. This affects Jenkins versions up to 2.587 and LTS 2.580.1.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins).

## Quick answers

**Is CVE-2026-117616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117616 being exploited in the wild.

**How severe is CVE-2026-117616?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Jenkins 2.587 and earlier; LTS 2.580.1 and earlier.

**Is there a fix for CVE-2026-117616?** Yes: fixed in Jenkins 2.588, LTS 2.580.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117616 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-117616?** Check whether you run Jenkins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Jenkins 2.588, LTS 2.580.2

## Technical details

Jenkins 2.587 and earlier lacks validation on the agent name parameter in an HTTP endpoint that loads agent configurations. An attacker with Overall/Read permission can use path traversal (CVE-2026-117616 / SECURITY-4188) to load arbitrary config.xml files from the controller filesystem, or overwrite them during agent save operations, allowing arbitrary code execution. The vulnerability requires at least read-level permissions and does not involve deserialization filters but rather direct file path manipulation.

## Affected products

- Jenkins Jenkins 2.587 and earlier; LTS 2.580.1 and earlier

## Timeline

- 2026-10-28: disclosed

## References

- [https://www.jenkins.io/security/advisory/2026-10-28/](https://www.jenkins.io/security/advisory/2026-10-28/)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)