CVE-2025-31721
Fixed in a distro release EPSS <1%CVSS 4.3
A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.504 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.492.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jenkins-2.479 | 0 |
| Chainguard | jenkins-2.479-compat | 0 |
| Chainguard | jenkins-2.479-remoting | 0 |
| Chainguard | jenkins-2.492 | 2.492.3-r4 |
| Wolfi | jenkins-2.479 | 0 |
| Wolfi | jenkins-2.479-compat | 0 |
| Wolfi | jenkins-2.479-remoting | 0 |