Executive brief
Jenkins is a popular open-source automation and continuous integration server used to orchestrate software builds and deployments. A vulnerability in the REST API and CLI endpoints allows users with permission to configure one agent to hijack the configuration of a different agent, gaining access to sensitive credentials and environment variables. This could enable attackers to compromise build pipelines or gain access to systems connected through compromised agents.
Technical details
The vulnerability exists in Jenkins REST API and CLI endpoints for agent configuration that fail to validate that submitted XML documents target only the intended agent. An attacker with Agent/Configure permission on one agent can specify a different agent's name in the submitted XML, causing the configuration update to overwrite the target agent's settings instead. This allows an attacker to extract the inbound agent secret and environment variables from the compromised agent. No authentication bypass is required; the vulnerability requires existing Agent/Configure permissions on at least one agent. Patches are available in Jenkins 2.580 and LTS 2.568.3.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Jenkins 2.580 and LTS 2.568.3