CVE-2025-59474: Jenkins Auth Bypass Vulnerability

CVE-2025-59474 Overview

CVE-2025-59474 is a missing authorization vulnerability [CWE-862] in Jenkins, the widely used open-source automation server. Jenkins versions 2.527 and earlier, along with LTS 2.516.2 and earlier, fail to enforce a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission. The sidepanel executors widget exposes agent names to unauthenticated or low-privilege attackers. This enables information disclosure about the Jenkins build infrastructure without requiring authentication.

Critical Impact
Attackers without Overall/Read permission can enumerate Jenkins agent names, exposing internal build infrastructure details useful for reconnaissance and follow-on attacks.

Affected Products

Jenkins weekly releases 2.527 and earlier
Jenkins LTS 2.516.2 and earlier
Jenkins controllers exposing pages accessible without Overall/Read permission

Discovery Timeline

2025-09-17 - Jenkins publishes security advisory SECURITY-3594
2025-09-17 - CVE-2025-59474 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59474

Vulnerability Analysis

The vulnerability resides in the sidepanel executors widget rendered on Jenkins pages that are intentionally exposed to users without Overall/Read permission. Jenkins allows certain pages, such as the login page or specific public endpoints, to be reachable by anonymous users. The sidepanel component on those pages renders the executors widget, which lists agent names available to the controller. Because the widget does not perform an independent permission check, agent identifiers are returned to any requester who can reach those pages. An attacker can harvest agent names to map build capacity, identify targets for further attacks, and infer environment segmentation.

Root Cause

The root cause is a missing authorization check [CWE-862] in the sidepanel executors widget. Jenkins expects callers of the widget to already possess Overall/Read permission, but the widget renders on pages designed for lower-privileged access. The widget does not re-validate the caller's permissions before enumerating agent names, resulting in inconsistent access control between the parent page and its embedded component.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to a Jenkins page reachable without Overall/Read permission. The server-rendered sidepanel includes the executors widget, which enumerates connected agents by name in the response body. The attacker parses the response to extract agent identifiers. No authentication, user interaction, or specialized tooling is required. The full technical description is available in the Jenkins Security Advisory SECURITY-3594.

Detection Methods for CVE-2025-59474

Indicators of Compromise

Unauthenticated HTTP GET requests to Jenkins endpoints that return HTML containing the executors sidepanel widget
Repeated anonymous requests to /login, /signup, or other pages accessible without Overall/Read permission
Web server or reverse proxy logs showing scraping patterns targeting Jenkins pages from a single source

Detection Strategies

Inspect Jenkins access logs for anonymous sessions retrieving pages that expose the sidepanel widget
Compare Jenkins controller version against 2.527 and LTS 2.516.2 to confirm exposure
Correlate reconnaissance-style HTTP request patterns against Jenkins with subsequent authentication attempts on identified agents

Monitoring Recommendations

Forward Jenkins controller access logs to a centralized log platform and alert on high-volume anonymous requests
Monitor for outbound references to internal agent hostnames appearing in external threat intelligence feeds
Track Jenkins version drift across environments to detect controllers running vulnerable releases

How to Mitigate CVE-2025-59474

Immediate Actions Required

Upgrade Jenkins weekly to 2.528 or later, and Jenkins LTS to 2.516.3 or later, per the vendor advisory
Restrict network access to Jenkins controllers so that only trusted networks can reach the web interface
Enable authentication and disable anonymous read access where operationally feasible

Patch Information

Jenkins addressed the missing permission check in releases published alongside the Jenkins Security Advisory SECURITY-3594. Fixed versions are Jenkins 2.528 (weekly) and Jenkins LTS 2.516.3. The patched code performs the required permission check before rendering the executors widget in the sidepanel. Additional discussion is available in the OpenWall OSS Security Discussion.

Workarounds

Place Jenkins behind a reverse proxy or VPN that requires authentication before requests reach the controller
Configure the security realm to require authentication for all pages, removing anonymous access to endpoints that expose the sidepanel
Rename agents to use non-descriptive identifiers so leaked names reveal less about internal infrastructure

bash

# Verify installed Jenkins version and upgrade on Debian/Ubuntu
dpkg -l | grep jenkins
sudo apt-get update
sudo apt-get install --only-upgrade jenkins
sudo systemctl restart jenkins