Jenkins: low-privilege user can seed Manage Old Data warnings that overwrite user accounts including passwords

Impact

A user with only Overall/Read can trigger warnings in the "Manage Old Data" feature carrying attacker-controlled data. When an administrator acts on those warnings - the normal housekeeping action - the data is applied and can override existing user account records, including login passwords. That is account takeover of a Jenkins admin by way of a routine maintenance click, giving control of the pipelines that build and deploy to the GPU fleet. Exploitation depends on an administrator taking the bait, which is why the vector keeps UI:N but the real path runs through an operator. Scored 8.8 by the CNA.

Who can reach it

Any authenticated user with Overall/Read, over the network; final impact requires an administrator to process the Manage Old Data entries.

What to do

Upgrade to the fixed weekly and LTS releases from the 2026-10-28 advisory and restart the controller; version numbers are not given in this record. Before patching, do not act on unexplained Manage Old Data entries and review existing user records for unexpected changes.

References

Related entries

• Jenkins: root element check bypass allows nesting types meant to live only in top-level config filesCVE-2026-117624 · Jenkins controller (XStream root element check for top-level configuration types)High
• MinIO: unsigned x-amz-* headers accepted in SigV4, escalating a presigned PUT into a cross-bucket readCVE-2026-122267 · MinIO (S3 Signature V4 verification)High
• Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High
• Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole): The RHOAI overlayCVE-2026-18951 · Kubeflow Training Operator (RHOAI overlay, trainjobs aggregated into the edit ClusterRole)High
• NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID): An attacker who already has valid credentialsCVE-2026-22049 · NetApp ONTAP WebAuthn multi-factor authentication (Relying Party ID)High
• Apache CloudStack: an account user registering a KVM template executes arbitrary code on the KVM hostsCVE-2026-25077 · Apache CloudStack (KVM template registration, direct-download file name handling)High