Jenkins: agent-computed workspace browser URLs give a compromised agent stored XSS on the controller

Impact

The workspace browser asks the agent for the link URL of each file and directory, so an attacker controlling an agent process can return a URL that executes script in the browser of anyone viewing that workspace. Build agents on a GPU fleet are the least trusted machines in the CI estate - they run tenant and contributor code on the accelerators - and this turns one of them into a foothold against operators who hold Jenkins admin sessions. The CVSS scope change reflects that the script runs in the controller's origin, where it can drive the controller's API as the viewing user. Affects Jenkins 2.587 and earlier and LTS 2.580.1 and earlier.

Who can reach it

An attacker in control of an agent process - typically via a job that executes untrusted build code on that agent. Exploitation needs an operator to then open the workspace browser for that agent (UI:R in the vector); no authentication to the controller is required of the attacker.

What to do

Upgrade the Jenkins controller past 2.587, or past LTS 2.580.1, per the 2026-10-28 advisory, and restart the controller; the record does not state the fixed version, so take it from the advisory. This is a controller restart with builds drained, not a node operation. Until then, treat agents that run untrusted code as hostile and avoid browsing their workspaces from an admin session.

References

Related entries

• Jenkins: agents can send HttpResponse-implementing exceptions to the controller, yielding XSSCVE-2026-117622 · Jenkins core (agent-to-controller exceptions implementing Stapler HttpResponse)Medium
• SPI flash configuration (flash descriptor / protected range registers) across multiple Intel platformsCVE-2017-5703 · SPI flash configuration (flash descriptor / protected range registers) across multiple Intel platformsMedium
• Intel Data Center GPU Max Series 1100 / 1550: An improper conditions check lets a privileged local user takeCVE-2023-47165 · Intel Data Center GPU Max Series 1100 / 1550Medium
• AMD PCIe link handling (memory buffer bounds): A guest VM can drive the PCIe link into an out-of-bounds conditionCVE-2024-21961 · AMD PCIe link handling (memory buffer bounds)Medium
• NetApp ONTAP, StorageGRID and SANtricity: trust in eight compromised eMudhra intermediate CAsCVE-2026-22063 · NetApp ONTAP 9 / StorageGRID / E-Series SANtricity OS (trusted CA certificate store)Medium
• OpenStack Swift: S3API does not strip X-Copy-From, allowing cross-tenant object readsCVE-2026-71192 · OpenStack Swift S3API middleware (X-Copy-From header handling with s3_acl=true)Medium