CVE-2026-117619 Jenkins Project CVE debrief

Who should care

Jenkins administrators and security teams should assess exposure and prioritize remediation. They should review compensating controls for exposed systems while remediation is scheduled and verified. Affected operator, platform, vulnerability-management, and security-team impact should be considered. Defenders should verify API token revocation and 'remember me' cookie invalidation.

Why it matters

CVE-2026-117619 allows attackers with a revoked or expired Jenkins API token to retain access via a 'remember me' cookie, impacting Jenkins administrators and security teams.

• Verify API token revocation and 'remember me' cookie invalidation
• Assess Jenkins instance exposure to HTTP Basic authentication with API tokens
• Prioritize upgrading to a fixed Jenkins version

Technical summary

CVE-2026-117619 affects Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, allowing attackers with a revoked or expired API token to retain access via a 'remember me' cookie. This vulnerability impacts Jenkins administrators and security teams, who should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. The vulnerability allows attackers to retain access via a 'remember me' cookie after the API token is revoked or expires.

Defensive priority

Defenders should assess Jenkins instances using HTTP Basic authentication with API tokens and prioritize upgrading to a fixed version.

Recommended defensive actions

• Assess Jenkins instance exposure to HTTP Basic authentication with API tokens
• Prioritize upgrading to a fixed Jenkins version
• Verify user API token revocation and 'remember me' cookie invalidation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and a vendor advisory link. The vulnerability allows attackers with a revoked or expired Jenkins API token to retain access via a 'remember me' cookie. Defenders should verify API token revocation and 'remember me' cookie invalidation. The vendor advisory provides mitigation details. Jenkins administrators and security teams should assess exposure and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.