Zero Radar
← feed
HighVulnerabilityupdated 29 Oct 2026, 15:53 UTC

Jenkins automation server has several security holes

Jenkins is a tool that builds and deploys software automatically. Attackers could exploit several flaws to gain admin rights, run their own code, or read and change data.

Fix availableOfficial, 3 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesJenkins 2.588 and Jenkins LTS 2.580.2. · since 29 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

What happened

Multiple vulnerabilities in Jenkins core allow privilege escalation, arbitrary code execution, security control bypass, data disclosure and manipulation, and cross-site scripting. Individual flaw details are in the official advisory.

Why it is dangerous: An attacker who abuses these flaws could take control of the Jenkins server and the build pipelines and secrets it manages, affecting the software your organization ships.

Are you affected?

You are affected if you run Jenkins core versions older than 2.588 (weekly line) or older than LTS 2.580.2.

Jenkins core: versions before 2.588 and LTS versions before 2.580.2 (exact affected ranges per advisory: unknown).

What to do

  1. Update Jenkins core to 2.588 or later (weekly) or LTS 2.580.2 or later
  2. Review the official Jenkins security advisory 2026-10-28 for per-flaw details and any plugin updates
  3. Check Jenkins logs and user/admin accounts for unexpected activity if you were running an older version

Timeline

  1. 28 Oct 2026, 12:00 UTC
    Publicly disclosed
  2. 28 Oct 2026, 16:26 UTC
    Picked up by Zero Radar
  3. 28 Oct 2026, 16:42 UTC
    Reported by oss-security · oss-security
  4. 28 Oct 2026, 16:45 UTC
    Jenkins reported on it · Jenkins
  5. 29 Oct 2026, 15:53 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
ZR-c85ddbab · ZR-b585d2d4 · ZR-d674c1f1
Disclosed
28 Oct 2026, 12:00 UTC
On Zero Radar
28 Oct 2026, 16:26 UTC (4 h after disclosure)
Last change
29 Oct 2026, 15:53 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Jenkins automation server has several security holes · Zero Radar