Database/Control plane, storage & DevOps
Jenkins: API-token requests can mint a remember-me cookie that survives token revocation
Impact
Requests authenticated with HTTP Basic auth, including those using an API token, are allowed to obtain a "remember me" cookie. An attacker who has captured a user's API token can convert it into a cookie that keeps working after the token is revoked or expires, so the standard incident response - rotate the token - does not actually evict them. For a Jenkins controller that drives GPU cluster deploys, that turns a leaked CI token into persistent access. Confidentiality and integrity impact, no availability impact; scored 8.1 by the CNA.
Who can reach it
Network, with a stolen or leaked API token for any Jenkins user; no interactive login needed.
What to do
Upgrade to the fixed weekly and LTS releases from the 2026-10-28 advisory and restart the controller; the record does not name the fixed versions. Because revoking a token is not sufficient on its own, after patching also invalidate existing sessions and remember-me cookies for any user whose token you believe was exposed.
References
Related entries
- N-able N-central: Incomplete patch for CVE-2026-18556CVE-2026-18577 · N-able N-centralHigh
- VMware Aria Operations (command injection during assisted migration): An unauthenticated attacker injects commandsCVE-2026-22719 · VMware Aria Operations (command injection during assisted migration)High
- Grafana Snowflake datasource: query access allows reading and writing files on the Grafana serverCVE-2026-28381 · Grafana Snowflake datasource (GET/PUT file commands)High
- Apache Airflow: any authenticated task instance can read or decide another task instance's HITL approvalsCVE-2026-30911 · Apache Airflow Execution API (Human-in-the-Loop endpoints)High
- Airflow Google provider: GCS object names with .. segments write outside the destination pathCVE-2026-49297 · Apache Airflow Google provider (GCSToSFTPOperator, GCSTimeSpanFileTransformOperator path handling)High
- OpenStack glance_store: VMware datastore driver sends authentication headers to an attacker-supplied image location hostCVE-2026-51773 · OpenStack glance_store (VMware datastore driver, _retry_request)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.