CVE catalog

CVE-2026-53441

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST

[CVE catalog]

Severity: Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published: Jun 10, 2026, 1:06:01 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 25, 2026

A flaw was found in Jenkins. This vulnerability, a stored cross-site scripting (XSS) issue, allows attackers with Agent/Configure permission to inject malicious scripts into the user-provided description of a generic offline cause. When other users view this description, the injected script can execute in their browser, potentially leading to information disclosure or unauthorized actions. jenkins: Jenkins: Stored Cross-Site Scripting (XSS) via unescaped user-provided description The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	jenkins	Not reported	`2.568`	fixed
Cpe	jenkins	Not reported	`2.555.3`	fixed
Cpe	jenkins	Not reported	`2.555.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	jenkins	cpe	Not reported	`2.568`	Not reported	Not reported	Not reported
Cpe	jenkins	cpe	Not reported	`2.555.3`	Not reported	Not reported	Not reported
Cpe	jenkins	cpe	Not reported	`2.555.3`	Not reported	NVD-CVE-2026-53441	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 26, 2026, 12:30:05 PM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]