Jenkins HTTP Proxy Configuration Disclosure (CVE-2026-117625)

CVE-2026-117625 is a missing permission check in Jenkins core, the open source automation server. One HTTP endpoint does not verify the caller's permission. An attacker who holds Overall/Read can use it to read the server, port, user name and no-proxy host list of the controller's HTTP proxy.

Overall/Read is the basic permission to see Jenkins at all. The Jenkins advisory (SECURITY-4206) rates the issue Medium. It lists no password among the leaked proxy fields, so the listed exposure is network layout and a proxy account name.

Why a Proxy Setting Matters

Our reading is that the data helps reconnaissance, not access. A proxy host and a user name tell an attacker how the build server reaches the internet and which account the proxy sees. That can help guess credentials or plan later steps against the proxy.

The advisory lists no further impact for this item. It is one of two Medium flaws among 15 fixed that day. It should ride along with the patch you need for the High ones.

How the Score Reads

Jenkins, the CNA, gives no CVSS score in the record, only the Medium severity in its advisory. CISA's enrichment, listed by NVD as a secondary source, scores it CVSS 3.1 4.3 Medium with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and classes the weakness as CWE-862, missing authorization. There is no CVSS 4.0 score in the record or NVD.

The low-privilege requirement matches Overall/Read. Our CVSS entry explains the vector fields, and the least privilege entry covers why broad read access matters here.

What Jenkins, CISA SSVC and KEV Say

Jenkins fixed the issue in 2.588 and LTS 2.580.2, which require Overall/Administer permission for the affected endpoint. CISA's SSVC record in the CVE entry lists exploitation as none, automatable as no and technical impact as partial, dated 5 November 2026.

As of CISA catalog version 2026.11.04, the CVE is not in the Known Exploited Vulnerabilities catalog. FIRST's EPSS gave it a score of 0.0017 at percentile 0.06458 on 5 November 2026. Our EPSS entry explains the score.

The Same Advisory Fixes More

The 28 October 2026 advisory covers 15 Jenkins core flaws, 13 rated High and two Medium. The High ones include a remote code execution flaw in XStream deserialization (CVE-2026-117612) and a race condition in the setup wizard that lets unauthenticated attackers create an administrator account (CVE-2026-117618). The other Medium flaw is a file browser path traversal (CVE-2026-117626).

The same two releases fix all 15, so patching for the High items also closes this one. See our TeamCity authentication bypass page for how a build server flaw looks once attackers exploit it.

The Jenkins advisory and the CVE record agree on the range. Jenkins weekly releases up to and including 2.587 are affected, and so are LTS releases up to and including 2.580.1. The CVE record marks 2.588 and LTS 2.580.2 as unaffected, and all earlier versions as affected by default.

The advisory says all prior versions are affected unless otherwise indicated. The fixed releases require Overall/Administer for the endpoint. The advisory gives no workaround for this item, so we recommend updating rather than adjusting permissions alone.

Jenkins credits the Anthropic OSS program for reporting SECURITY-4206. Our vulnerability management guide covers how to track a rollout like this, and the patch management entry covers the process.