CVE-2015-5326: Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before...

Security readout for executives and security teams

This is an authenticated XSS flaw in a Jenkins node overview page. A permitted user could place malicious HTML or script in a node offline status message, which could run when another user views that page. Business risk depends on Jenkins exposure, user permissions, and who administers nodes. Exposure is most likely in older Jenkins deployments below 1.638 or LTS below 1.625.2, especially where many authenticated users can manage agents or offline messages. Internet exposure increases concern, but the source states authentication and specific permissions are required. Treat as a targeted cleanup item for legacy Jenkins. It is not KEV-listed, but Jenkins is operationally sensitive, so vulnerable instances should be upgraded and permissions reviewed during the next security maintenance window. Mitigation focus: Upgrade Jenkins to 1.638, LTS 1.625.2, or later where applicable.; Review the Jenkins 2015-11-11 security advisory for vendor-specific remediation details.; Apply relevant Red Hat security updates if using Red Hat-packaged Jenkins components..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.