CVE-2026-117618

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

8.1 HIGHEPSS 0.26%Not in KEVNVD: Modified

Last updated: 2026-11-05 20:17 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.1	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID: CVE-2026-117618
Status: Modified
Assigner (CNA): jenkins
Published: Oct 28, 2026
Last modified: 2026-11-05 20:17 UTC
Weaknesses: CWE-362

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:23 UTC.