Sign in
Deutsch English Español Polski
Medium

Missing permission check for paths with specific prefix in Jenkins

  • Disclosed: 24.05.2022
  • Updated: 11.10.2026 11:22

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list.

This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required:

  • accessDenied
  • error
  • instance-identity
  • login
  • logout
  • oops
  • securityRealm
  • signup
  • tcpSlaveAgentListener

For example, a plugin contributing the path loginFoo/ would have URLs in that space accessible without the default Overall/Read permission check.

The Jenkins security team is not aware of any affected plugins as of the publication of this advisory.

The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2.

In case this change causes problems, additional paths can be made accessible without Overall/Read permissions: The Java system property jenkins.model.Jenkins.additionalReadablePaths is a comma-separated list of additional path prefixes to allow access to.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-863
Platform
Java / Kotlin (Maven)
Package
org.jenkins-ci.main:jenkins-core
Disclosed
24.05.2022
Updated
11.10.2026 11:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4625-q52w-39cx - CC BY 4.0

Vulnerability history: org.jenkins-ci.main:jenkins-core

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (259) in the archive
Total entries
259
First → latest
01.2022 06.2026
Without a fix
1
Exploited in attacks
4

Severity breakdown

  • Critical 19
  • High 62
  • Medium 158
  • Low 20

Disclosures per year

Severity:
  1. Missing permission check for paths with specific prefix in Jenkins this entry
    Medium · 5.3 CVE-2021-21609 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  2. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    High · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  3. Jenkins: Stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  4. Jenkins has a link following vulnerability allows arbitrary file creation
    High · 8.8 CVE-2026-33001 < 2.555 2.555
  5. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    High · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  6. Jenkins has a stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  7. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    High · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  8. Jenkins Remoting library arbitrary file read vulnerability
    High · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  9. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Critical · 9.8 Exploited in attacks CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  10. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    High · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  11. Jenkins temporary plugin file created with insecure permissions
    High · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  13. Jenkins Stored Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  14. Jenkins CSRF protection bypass vulnerability
    High · 8.0 CVE-2023-35141 < 2.400 2.400
  15. Cross-site Scripting vulnerability in Jenkins
    High · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  16. Incorrect Authorization in Jenkins Core
    High · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  17. Denial of service in Jenkins Core
    High · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  18. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    High · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  19. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  20. Unauthorized view fragment access in Jenkins
    High · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
Show more (20) Showing 21 of 82

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.