UpHeron
All vulnerabilities

Servers and applications

CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

Severity
High 8.1
Published
28 Oct 2026
Last changed
2 Nov 2026
Added to UpHeron
3 Nov 2026
Fixed in
2.580.2, 2.588
Sources
NVD, CVE Program

Affected software

SoftwareAffected versions
JenkinsServers and applications · cna:jenkins project|jenkins
  • Every version before 2.588
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • Every version before 2.580.2
  • Every version before 2.588

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-117618
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-117618