CVE-2026-117612

jenkins: Jenkins: Remote code execution via resolves-to attribute handling in XStream

jenkins

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

28. Okt 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• Hersteller
  https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4125
• NVD
  CVE-2026-117612