Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-27099

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline c

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jenkins

Description

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jenkins Project Jenkins

Default version status: affected

  • 0 to < 2.483unaffected
  • 2.551 to < *unaffected
  • 2.541.2 to < 2.541.*unaffected

References