Jenkins security advisory 2026-10-28: 15 core vulnerabilities (XStream deserialization RCE, agent launch command approval bypass, setup wizard admin creation, path traversal, stored XSS). Which versions fix them?

What it is: On October 28, 2026 the Jenkins project fixed 15 vulnerabilities in Jenkins core (no plugins), 13 rated high. The most serious: SECURITY-4125 / CVE-2026-117612 and SECURITY-4243 / CVE-2026-117624 (XStream deserialization protections could be bypassed, leading to code execution on the controller), SECURITY-4123 / CVE-2026-117614 (bypass of the approval for agent launch commands, also code execution on the controller), SECURITY-4122 / CVE-2026-117618 (a race in the setup wizard can let an unauthenticated user create an admin account on a fresh install), path traversal and symlink issues that overwrite config files or read arbitrary files, and several stored XSS flaws, one of which (SECURITY-4226) can lead to admin account takeover. SECURITY-4189 also notes that 'remember me' cookies could be obtained with an API token and survive revoking the token. Am I affected: - Jenkins weekly 2.587 or earlier, or LTS 2.580.1 or earlier. Check Manage Jenkins > About Jenkins, or the version in the page footer. - Jenkins controllers are high-value targets (they hold credentials for source control, clouds and deploy targets), so treat this as urgent even though no exploitation was reported at release. Fix: 1. Upgrade to Jenkins weekly 2.588 or LTS 2.580.2 (or later). For Docker, pull jenkins/jenkins:2.580.2-lts (or newer) and redeploy. 2. If the upgrade causes problems with the new XStream type checks, the advisory documents temporary system properties (hudson.util.XStream2.SUPPRESS_TYPE_PERMISSION and the RobustReflectionConverter options); use them only as a short-term fallback, since they weaken the fix. 3. Until upgraded: on 2.539+ / LTS 2.541.1+, enforce the Content Security Policy, which the advisory says mitigates three of the XSS issues; keep the controller off the public internet; never leave a new instance in the setup wizard on a reachable network. 4. After upgrading, have users sign out and back in (or invalidate sessions) and rotate API tokens of admin accounts, because of the 'remember me' cookie issue. Verify: About Jenkins shows 2.588+ or 2.580.2+; review recent changes to users, agents and system configuration for anything unexpected. Sources: https://www.jenkins.io/security/advisory/2026-10-28/ https://securityonline.info/jenkins-vulnerabilities-october-2026/ https://www.jenkins.io/changelog-stable/