CVE-2026-53441

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Score

CVSS 3.1 5.4 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2026-06-10

Last modified

2026-10-26

Weaknesses

CWE-79

Affected products

• Jenkins (Jenkins)
• Jenkins (Jenkins Project)

References

• https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3731