Remote code execution in Infrastructure Services
BEE-75717 / CVE-2026-111497
Severity (CVSS): Critical
Description:
The infrastructure services (managed-master-hibernation-monitor, cloudbees-casc-bundle-service, cloudbees-casc-scm-bundle-retriever, pluggable-storage-service, sso-relay-service, and ci-mcp-router) have an HTTP interface that accepts compressed input.
In prior versions of the services, the brotli decoder was susceptible to an out-of-bounds write that could lead to remote code execution.
Additionally, some services by design have their HTTP port exposed out of the cluster and by necessity accept anonymous connections, greatly reducing the barriers to exploit.
The infrastructure services in 2.580.2.38435 have had the vulnerable library updated to 1.24 which is unaffected by this issue.
Note
Warning
Tip
Fix
- CloudBees Traditional Platforms should be upgraded to 2.580.2.38435
- CloudBees Cloud Platforms should be upgraded to 2.580.2.38435
Subscribe to
security alerts
Get notified when new vulnerabilities are disclosed.
Subscription confirmed
You'll now be notified automatically when new vulnerabilities are disclosed