PT-2026-128306
CVE-2026-117618
·
Published
2026-10-28
·
Updated
2026-10-29
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.
Found an issue in the description? Have something to add? Feel free to write us 👾