PT-2026-48426 · Jenkins · Jenkins

Wooseokdotkim · CVE-2026-53441 · Published 2026-06-10 · Updated 2026-07-06

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.483 through 2.567 Jenkins LTS versions 2.492.1 through 2.555.2

Description Insufficient escaping of user-provided descriptions for generic offline causes allows for stored cross-site scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users. This issue is exploitable by attackers possessing Agent/Configure permissions via the 'POST config.xml' API endpoint.

Recommendations Update Jenkins to a version later than 2.567. Update Jenkins LTS to a version later than 2.555.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2026-53441

CVE-2026-53441

GHSA-93QH-VWRM-C5PW

Affected Products

Jenkins

References · 11

• https://jenkins.io/security/advisory/2026-06-10/#SECURITY-3731 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2026-53441 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53441 · Security Note
• https://osv.dev/vulnerability/GHSA-93qh-vwrm-c5pw · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/20041e8090d3b228d586169141ea7f12ffe4444d · Note
• https://github.com/jenkinsci/jenkins · Note
• https://twitter.com/CVEnew/status/2064709788529737987 · Twitter Post
• https://t.me/CVEtracker/56460 · Telegram Post
• https://i.redd.it/uvpceyvxif8h1.png · Reddit Post
• https://t.me/cveNotify/188797 · Telegram Post