CVE-2026-117618: Setup wizard / Jenkins own user database signup endpoint

Executive Summary & Technical Impact

An endpoint that lets unauthenticated users create the first account when no accounts exist did not check whether the setup wizard had completed, so an unauthenticated attacker could create an administrator account while the initial account was being replaced.

Tracked under CVE-2026-117618 (CWE-362 (Race Condition)), this vulnerability affects Jenkins weekly 2.587 and earlier; LTS 2.580.1 and earlier and carries a severity score of High (Jenkins) (HIGH). Engineering and security operations teams running Jenkins (core) should prioritize upgrading to Jenkins weekly 2.588; LTS 2.580.2.

Remediation & Patch Guidance

1. Upgrade Jenkins weekly to 2.588 or Jenkins LTS to 2.580.2.
2. Never expose a fresh Jenkins installation to untrusted networks before setup is complete.
3. Review the user list on recently provisioned controllers for unexpected administrator accounts.

Frequently Asked Questions (CVE-2026-117618)

What versions are affected by CVE-2026-117618?

CVE-2026-117618 affects Jenkins weekly 2.587 and earlier; LTS 2.580.1 and earlier in Jenkins (core) (Setup wizard / Jenkins own user database signup endpoint).

How do I patch or remediate CVE-2026-117618?

Upgrade affected deployments to Jenkins weekly 2.588; LTS 2.580.2 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-117618?

CVE-2026-117618 is rated HIGH with a CVSS score of High (Jenkins) (vector: Network; unauthenticated, during initial setup).