Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obta

Summary

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.

Remediation

1. Inventory every Jenkins Jenkins deployment, including staging.
2. Upgrade Jenkins Jenkins to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4189