CVE-2026-117612: XStream deserialization (resolves-to attribute)

Executive Summary & Technical Impact

The custom XStream converter in Jenkins did not apply the JEP-200 deserialization filter to classes referenced by the resolves-to attribute, letting attackers with Overall/Read and a user account (or config.xml POST permission) instantiate arbitrary types and potentially achieve remote code execution on the controller.

Tracked under CVE-2026-117612 (CWE-502 (Deserialization of Untrusted Data)), this vulnerability affects Jenkins weekly 2.587 and earlier; LTS 2.580.1 and earlier and carries a severity score of High (Jenkins) (HIGH). Engineering and security operations teams running Jenkins (core) should prioritize upgrading to Jenkins weekly 2.588; LTS 2.580.2.

Remediation & Patch Guidance

1. Upgrade Jenkins weekly to 2.588 or Jenkins LTS to 2.580.2.
2. Audit who holds Overall/Read and any */Configure permissions; remove broad grants to anonymous or all authenticated users.
3. Rotate controller-held credentials if untrusted users had configure permissions before patching.

Frequently Asked Questions (CVE-2026-117612)

What versions are affected by CVE-2026-117612?

CVE-2026-117612 affects Jenkins weekly 2.587 and earlier; LTS 2.580.1 and earlier in Jenkins (core) (XStream deserialization (resolves-to attribute)).

How do I patch or remediate CVE-2026-117612?

Upgrade affected deployments to Jenkins weekly 2.588; LTS 2.580.2 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-117612?

CVE-2026-117612 is rated HIGH with a CVSS score of High (Jenkins) (vector: Network; requires Overall/Read plus a user account or config.xml POST permission).