CVE-2026-53441

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.483 through 2.567 Jenkins LTS versions 2.492.1 through 2.555.2

Description Insufficient escaping of user-provided descriptions for generic offline causes allows for stored cross-site scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users. This issue is exploitable by attackers possessing Agent/Configure permissions via the 'POST config.xml' API endpoint.

Recommendations Update Jenkins to a version later than 2.567. Update Jenkins LTS to a version later than 2.555.2.