CVE WatchOct 28, 2026

CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 28, 2026 · Last modified: Oct 28, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

Official references

www.jenkins.iohttps://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4122

Related CVEs

No related CVEs by CWE or product.