5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53441

CVE-2026-53441: Jenkins: Stored XSS vulnerability in node offline cause description

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53441

CVE-2026-53441:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.main:jenkins-core	maven	>= 2.483, <= 2.567	2.568

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored cross-site scripting (XSS) issue in Jenkins. It occurs when an attacker with Agent/Configure permission sends a specially crafted config.xml via a POST request to update an agent's configuration. The root cause is the improper handling of the agent's offline cause description.

The analysis of the patch commit 20041e8090d3b228d586169141ea7f12ffe4444d reveals the following:

Entry Point: The added test case postConfigXmlWithNonUserCause in jenkins.security.Security3669Test.java clearly shows that the vulnerability is triggered by calling hudson.model.Computer.updateByXml. This function accepts the XML configuration containing the XSS payload in the <description> tag of a hudson.slaves.OfflineCause$SimpleOfflineCause.
Vulnerable Rendering: The patch modifies the Jelly template hudson/slaves/OfflineCause/cause.jelly. The change from <j:out value="${it}" /> to ${it} is critical. The <j:out> tag performs HTML escaping. By removing it, the template now relies on the object it (which is an instance of OfflineCause) to provide a pre-escaped string via its toString() method. Before the patch, OfflineCause.toString() (specifically for SimpleOfflineCause) returned the raw description, which the UI would then render, executing any embedded scripts.
The Fix: The patch implies a change in the hudson.slaves.OfflineCause.toString() method to ensure it returns an HTML-escaped string. This is further evidenced by the removal of an overriding toString() method in the OfflineCause.UserCause inner class, suggesting the base class now handles the escaping, making the override redundant.

Therefore, during exploitation, a runtime profile would show calls to hudson.model.Computer.updateByXml when the malicious configuration is submitted, and subsequently, calls to hudson.slaves.OfflineCause.toString when the agent's status page is viewed, which is where the XSS payload would have been rendered.

Vulnerable functions

hudson.model.Computer.updateByXml

core/src/main/java/hudson/model/Computer.java

This function serves as the entry point for the vulnerability. It processes a user-provided XML configuration (`config.xml`) which can contain a malicious cross-site scripting payload within the `temporaryOfflineCause` description. The function parses this XML and updates the agent's state, storing the malicious payload.

hudson.slaves.OfflineCause.toString

core/src/main/java/hudson/slaves/OfflineCause.java

This function is responsible for generating the string representation of the offline cause, which is displayed in the Jenkins UI. In the vulnerable version, this method returned the raw, unescaped description provided by the user. When the UI rendered this string, the embedded malicious script would execute. The patch implies that this method is now responsible for HTML-escaping the description before returning it.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.