Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-59474

Fixed in a distro release EPSS 5%CVSS 5.3

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

Published 2025-09-17 · CVE record · OSV

Products: Jenkins project Jenkins

Fixed upstream

EcosystemPackageFixed in
Mavenorg.jenkins-ci.main:jenkins-core2.516.3
Mavenorg.jenkins-ci.main:jenkins-core2.528

Distro releases

ReleasePackageFixed in
Chainguardjenkins-22.528-r0
Chainguardjenkins-2-openjdk-172.528-r0
Chainguardjenkins-2-openjdk-212.528-r0
Chainguardjenkins-2.504-openjdk-17no fix
Chainguardjenkins-2.504-openjdk-21no fix
Chainguardjenkins-2.5162.516.3-r0
Chainguardjenkins-2.516-openjdk-172.516.3-r0
Chainguardjenkins-2.516-openjdk-212.516.3-r0
Chainguardjenkins-compat2.528-r0
Chainguardjenkins-docker-agent2.528-r0
Chainguardjenkins-docker-agent-openjdk-172.528-r0
Chainguardjenkins-docker-agent-openjdk-212.528-r0
Chainguardjenkins-remoting2.528-r0
Chainguardjenkins-utils2.528-r0
Wolfijenkins-22.528-r0
Wolfijenkins-2-openjdk-172.528-r0
Wolfijenkins-2-openjdk-212.528-r0
Wolfijenkins-compat2.528-r0
Wolfijenkins-docker-agent2.528-r0
Wolfijenkins-docker-agent-openjdk-172.528-r0
Wolfijenkins-docker-agent-openjdk-212.528-r0
Wolfijenkins-remoting2.528-r0
Wolfijenkins-utils2.528-r0