Database/Control plane, storage & DevOps
Jenkins: legacy agent launch commands run on the controller without script approval
Impact
Jenkins is the build and image-promotion path for many GPU fleets, so code running in the controller JVM holds the credentials used to push images and talk to the cluster. When converting older agent configurations into Command Agent Launcher launchers, Jenkins did not check whether the launch command had been approved by an administrator. A user with only Agent/Configure can therefore get arbitrary code execution as the controller, which is a full compromise of the CI identity rather than of one build. This is the highest-severity item in the 2026-10-28 advisory and the only one in it that yields controller code execution.
Who can reach it
An authenticated Jenkins user holding Agent/Configure permission, reaching the controller over HTTP. No host access required.
What to do
Upgrade Jenkins to a release later than 2.587, or LTS later than 2.580.1, per the 2026-10-28 advisory, and restart the controller. Controller restart interrupts running builds but touches no GPU nodes. In the meantime, withdraw Agent/Configure from users who do not need it.
References
Related entries
- Apache Airflow: crafted XCom payload executes code in the webserver contextCVE-2026-25917 · Apache Airflow (webserver XCom payload deserialization)High
- Apache Airflow: login redirect route can be crafted to send users to an attacker-controlled originCVE-2026-40961 · Apache Airflow webserver (login redirect route, is_safe_url bypass)High
- Dell OpenManage Enterprise: unauthenticated SSRF reaches services on the management networkCVE-2026-54794 · Dell OpenManage Enterprise (web interface)High
- Dell OpenManage Enterprise: privileged user can inject OS commands and run code on the applianceCVE-2026-54796 · Dell OpenManage Enterprise (OS command handling)High
- Ivanti Endpoint Manager Mobile: Improper input validationCVE-2026-6973 · Ivanti Endpoint Manager MobileHigh
- Dell OpenManage Enterprise: improper privilege management lets a privileged account escalate furtherCVE-2026-70421 · Dell OpenManage Enterprise (privilege management)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.