{"id":"CVE-2026-27099","aliases":["BIT-jenkins-2026-27099","EUVD-2026-8091","GHSA-85h6-5m3v-gx37","ROOT-APP-MAVEN-CVE-2026-27099"],"status":"published","title":"Jenkins has a stored XSS vulnerability in node offline cause description","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00481,"percentile":0.41945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-02-18T14:17:43Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.551","2.541.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"jenkins","fixed_in":["2.541.2","2.551.0"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.jenkins-ci.main:jenkins-core","fixed_in":["2.533-root.io.1","2.533-root.io.2","2.533-root.io.3","2.540-root.io.1","2.533-root.io.4","2.540-root.io.2","2.533-root.io.6","2.540-root.io.3","2.540-root.io.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.540-aikido.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.542"},{"fixed":"2.551"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.483"},{"fixed":"2.541.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jenkins","ranges":[{"type":"SEMVER","events":[{"introduced":"2.483.0"},{"fixed":"2.541.2"},{"introduced":"2.542.0"},{"fixed":"2.551.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.542"},{"fixed":"2.551"}]}],"versions":["2.542","2.543","2.544","2.545","2.546","2.547","2.548","2.549","2.550"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.483"},{"fixed":"2.541.2"}]}],"versions":["2.483","2.484","2.485","2.486","2.487","2.488","2.489","2.490","2.491","2.492","2.492.1","2.492.2","2.492.3","2.493","2.494","2.495","2.496","2.497","2.498","2.499","2.500","2.501","2.502","2.503","2.504","2.504.1","2.504.2","2.504.3","2.505","2.506","2.507","2.508","2.509","2.510","2.511","2.512","2.513","2.514","2.515","2.516","2.516.1","2.516.2","2.516.3","2.517","2.518","2.519","2.520","2.521","2.522","2.523","2.524","2.525","2.526","2.527","2.528","2.528.1","2.528.2","2.528.3","2.529","2.530","2.531","2.532","2.533","2.534","2.535","2.536","2.537","2.538","2.539","2.540","2.541","2.541.1"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.533-root.io.1"},{"fixed":"2.533-root.io.2"},{"fixed":"2.533-root.io.3"},{"fixed":"2.540-root.io.1"},{"fixed":"2.533-root.io.4"},{"fixed":"2.540-root.io.2"},{"fixed":"2.533-root.io.6"},{"fixed":"2.540-root.io.3"},{"fixed":"2.540-root.io.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.540-aikido.4"}]}]}],"products":[{"vendor":"jenkins","product":"jenkins"},{"vendor":"jenkins project","product":"jenkins"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-02-18/#SECURITY-3669","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27099","tags":["web","advisory"]},{"url":"https://github.com/jenkinsci/jenkins/commit/578c028e2cdfdc9e124d0ca389a80bb2bd231ab2","tags":["web"]},{"url":"https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.551","tags":["web"]},{"url":"https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.541.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-85h6-5m3v-gx37"},{"url":"https://github.com/jenkinsci/jenkins","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27099","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-18T14:17:43.911Z","modified":"2026-02-18T14:56:27.973Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-8091","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-18T14:17:43Z","modified":"2026-02-18T14:56:27Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:37.43406Z"}],"ghsa":[{"id":"GHSA-85h6-5m3v-gx37","title":"Jenkins has a stored XSS vulnerability in node offline cause description","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-18T15:31:27Z","modified":"2026-02-25T19:58:42Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2026-27099","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-18T15:18:43.857Z","modified":"2026-06-17T10:26:40.49Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"CVE-2026-27099","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-18T15:18:43.857Z","modified":"2026-10-24T10:30:44.146246064Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-85h6-5m3v-gx37","title":"Jenkins has a stored XSS vulnerability in node offline cause description","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-18T15:31:27Z","modified":"2026-09-10T03:50:34.505671332Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-27099","title":"CVE-2026-27099 in io.root.org.jenkins-ci.main:jenkins-core - Patched by Root","description":"Root has patched CVE-2026-27099 in the io.root.org.jenkins-ci.main:jenkins-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-21T09:05:00Z","modified":"2026-06-21T13:00:07.266504982Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"BIT-jenkins-2026-27099","description":"Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the \"Mark temporarily offline\" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.","status":"published","published":"2026-02-20T08:43:33.019Z","modified":"2026-09-08T08:48:00.982753081Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}