Jenkins has a stored XSS vulnerability in node offline cause description
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27099US | — | — | ||
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline c… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/jenkinsci/jenkinsPACKAGE
- https://github.com/jenkinsci/jenkins/commit/578c028e2cdfdc9e124d0ca389a80bb2bd231ab2WEB
- https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.541.2WEB
- https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.551WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-27099ADVISORY
- https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3669WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan