Database/Control plane, storage & DevOps
Jenkins: unauthenticated race on the setup wizard endpoint can create an administrator account
Impact
The HTTP endpoint that creates the first user account never checks whether the setup wizard has already finished. An unauthenticated attacker who hits it during the window in which the initial account is being replaced wins a race and creates an administrator account on a running Jenkins. No credentials are needed at all, which makes this the one bug in this advisory that an outsider reaching the controller's port can attempt. Exploitation needs the right timing, reflected in AC:H. Scored 8.1 by the CNA.
Who can reach it
Anyone who can reach the Jenkins controller's HTTP port, unauthenticated, during the account-replacement window.
What to do
Upgrade to the fixed weekly and LTS releases from the 2026-10-28 advisory and restart the controller; the fixed version numbers are not in this record. Also confirm the controller is not reachable from untrusted networks and review the administrator account list for entries you did not create.
References
Related entries
- Jenkins: API-token requests can mint a remember-me cookie that survives token revocationCVE-2026-117619 · Jenkins controller (HTTP Basic / API token authentication, "remember me" cookie)High
- N-able N-central: Incomplete patch for CVE-2026-18556CVE-2026-18577 · N-able N-centralHigh
- VMware Aria Operations (command injection during assisted migration): An unauthenticated attacker injects commandsCVE-2026-22719 · VMware Aria Operations (command injection during assisted migration)High
- Grafana Snowflake datasource: query access allows reading and writing files on the Grafana serverCVE-2026-28381 · Grafana Snowflake datasource (GET/PUT file commands)High
- Apache Airflow: any authenticated task instance can read or decide another task instance's HITL approvalsCVE-2026-30911 · Apache Airflow Execution API (Human-in-the-Loop endpoints)High
- Airflow Google provider: GCS object names with .. segments write outside the destination pathCVE-2026-49297 · Apache Airflow Google provider (GCSToSFTPOperator, GCSTimeSpanFileTransformOperator path handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.