PT-2026-48426

CVE-2026-53441

Published

2026-06-10

Updated

2026-08-12

Description by

CVSS 3.1

8.0

High

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.483 through 2.567 Jenkins LTS versions 2.492.1 through 2.555.2

Description Insufficient escaping of user-provided descriptions for generic offline causes allows for stored cross-site scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users. This issue is exploitable by attackers possessing Agent/Configure permissions via the 'POST config.xml' API endpoint.

Recommendations Update Jenkins to a version later than 2.567. Update Jenkins LTS to a version later than 2.555.2.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-53441

BDU:2026-15345