CVE-2025-59474
📋 TL;DR
This vulnerability allows attackers without Overall/Read permission in Jenkins to list agent names through the sidepanel executors widget. It affects Jenkins 2.527 and earlier, and LTS 2.516.2 and earlier. The issue occurs due to missing permission checks in a page component accessible to unauthorized users.
💻 Affected Systems
- Jenkins
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate all Jenkins agent names, potentially identifying build infrastructure for targeted attacks or reconnaissance.
Likely Case
Unauthorized users gain visibility into Jenkins agent infrastructure, enabling information gathering for further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to internal reconnaissance only.
🎯 Exploit Status
Requires some Jenkins user access (but not Overall/Read permission). Exploitation involves accessing specific UI components.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jenkins 2.528, Jenkins LTS 2.516.3
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3594
Restart Required: No
Instructions:
1. Backup your Jenkins instance. 2. Upgrade to Jenkins 2.528 or Jenkins LTS 2.516.3. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict access to Jenkins UI
allLimit network access to Jenkins web interface to authorized users only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jenkins from untrusted networks
- Review and tighten user permissions to minimize accounts with any Jenkins access
🔍 How to Verify
Check if Vulnerable:
Check Jenkins version via Manage Jenkins > About Jenkins or via CLI: java -jar jenkins.war --versionCheck Version:
java -jar jenkins.war --versionVerify Fix Applied:
Verify version is 2.528 or higher (or LTS 2.516.3 or higher) and test that unauthorized users cannot view agent names in sidepanel.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Jenkins UI from unauthorized users
- Multiple requests to sidepanel endpoints from low-privilege accounts
Network Indicators:
- Traffic to Jenkins web interface from unexpected sources
SIEM Query:
source="jenkins.log" AND (uri="/sidepanel/" OR uri="/executors/") AND user!="admin"