CVE-2026-117625 in Jenkins
Summary
by MITRE • 10/28/2026
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as CVE-2024-23897 represents a critical authorization bypass within Jenkins versions 2.587 and earlier, including LTS releases up to version 2.580.1. This flaw stems from the absence of an adequate permission check in specific administrative endpoints that handle HTTP proxy configuration data. In standard enterprise deployments, Jenkins serves as a central automation hub for continuous integration and delivery pipelines, often managing sensitive build configurations, credentials, and infrastructure settings. The security model relies heavily on Role-Based Access Control to restrict access to sensitive operational data based on user roles. However, in this instance, the system fails to validate whether a requesting user possesses sufficient privileges before disclosing proxy configuration details, thereby allowing users with only Overall/Read permissions to retrieve information that should be restricted to administrators or higher-privileged service accounts.
The technical nature of this flaw is classified as an authorization bypass due to missing access control checks on sensitive data retrieval endpoints. Specifically, the vulnerability allows authenticated attackers who have been granted basic read-only access across the Jenkins instance to query internal configuration parameters related to network connectivity. The exposed information includes the server address and port number of the configured HTTP proxy, along with the username used for authentication against that proxy and a list of hosts designated as no-proxy entries. This data leakage is significant because it provides attackers with detailed insights into the organization's external communication architecture. By understanding how Jenkins connects to the internet or internal networks through proxies, an attacker can map out network boundaries, identify potential pivot points, and potentially craft more targeted attacks against downstream systems that rely on similar proxy configurations for outbound traffic management.
From a risk perspective, this vulnerability falls under CWE-284, which describes Improper Access Control, specifically involving the failure to enforce proper authorization checks before granting access to sensitive resources. The exposure of network configuration details aligns with ATT&CK technique T1071.001, Application Layer Protocol: Web Protocols, as it involves abusing legitimate web-based administrative interfaces to gather reconnaissance data. Furthermore, this disclosure supports ATT&CK tactic TA0043, Reconnaissance, by enabling adversaries to perform network topology mapping and service discovery without triggering high-severity alerts associated with privilege escalation attempts. The operational impact is primarily centered on information disclosure that facilitates further exploitation phases such as lateral movement or targeted phishing campaigns against administrators who manage the proxy infrastructure.
Mitigation strategies for this vulnerability require immediate action from system administrators responsible for Jenkins instances running affected versions. The primary remediation step is to upgrade Jenkins to version 2.588 or later, where LTS users should target version 2.580.2 or newer, as these releases include the necessary code patches to enforce strict permission checks on proxy configuration endpoints. Until an upgrade can be performed, organizations should implement compensating controls such as restricting network access to Jenkins administrative interfaces using firewalls or reverse proxies that limit exposure to trusted IP ranges only. Additionally, reviewing and tightening role-based permissions is advisable; ensuring that users with Overall/Read privileges do not have unnecessary access to configuration endpoints can reduce the attack surface even if patching is delayed. Regular auditing of user roles and continuous monitoring for unauthorized data retrieval attempts are also recommended practices to maintain a robust security posture in CI/CD environments.