Jenkins Token Leak

MEDIUM (4.3) No Patch (4 days)
cwe-312apacheautomation-serverjenkinstoken-leak

Threat Intelligence

Low Risk
EPSS Score: 0.02% chance of exploitation (percentile: 4%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: No public exploits found

How we test →

What is it?

Jenkins is a popular open-source automation server for building, testing, and deploying software. The vulnerability in question allows attackers to access build authorization tokens stored unencrypted in job config.xml files on the Jenkins controller.

Am I affected?

Affected versions: 2.528.2, 2.540 If you don't recognise this software, you're probably not affected.

Affected Products

Jenkins Software Foundation / Jenkins

How to fix

  1. Upgrade to Jenkins 2.540.3 or later from the official Jenkins website: https://www.jenkins.io/download/
  2. If an immediate upgrade isn't possible, apply the following mitigations:
  3. Set securityToken to true in your Jenkins configuration file (/etc/jenkins/config.xml on Linux-based systems): This will encrypt the stored tokens.
  4. Restrict access to the Jenkins controller's file system by setting appropriate permissions or using a web application firewall (WAF).

References