CVE-2025-59475 Overview
CVE-2025-59475 is a missing authorization vulnerability in Jenkins, the widely deployed open-source automation server. Jenkins versions 2.527 and earlier, and LTS 2.516.2 and earlier, fail to perform a permission check on the authenticated user profile dropdown menu. Authenticated attackers without Overall/Read permission can enumerate menu options and infer configuration details about the Jenkins instance, such as whether the Credentials Plugin is installed. The issue is tracked under [CWE-862: Missing Authorization] and was disclosed in the Jenkins Security Advisory 2025-09-17.
Critical Impact
Authenticated users lacking Overall/Read permission can obtain limited but useful reconnaissance data about the Jenkins configuration, aiding follow-on attacks against installed plugins.
Affected Products
- Jenkins weekly releases 2.527 and earlier
- Jenkins LTS 2.516.2 and earlier
- Jenkins instances tracked as jenkins:jenkins component
Discovery Timeline
- 2025-09-17 - Jenkins publishes Security Advisory SECURITY-3625
- 2025-09-17 - CVE-2025-59475 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59475
Vulnerability Analysis
The vulnerability lives in the Jenkins web interface component that renders the authenticated user profile dropdown menu. Jenkins normally gates access to configuration and navigation elements behind the Overall/Read permission. In the affected versions, the dropdown rendering path skipped this permission check entirely. As a result, any user with valid credentials can query the menu and observe which entries appear.
The leaked entries reveal whether specific plugins or features are enabled on the controller. Knowing that the Credentials Plugin is installed, for example, tells an attacker that stored secrets exist and guides targeting of related plugin vulnerabilities. The information disclosed is limited, but it directly supports reconnaissance workflows against hardened Jenkins deployments where anonymous read is disabled.
Root Cause
The root cause is missing authorization enforcement [CWE-862] on the user profile dropdown rendering endpoint. The developer added the dropdown component without wiring it to the standard permission check applied to other navigation UI. The control assumed authentication alone is sufficient, which contradicts the Jenkins permission model that requires Overall/Read for configuration visibility.
Attack Vector
The attack requires network access to the Jenkins web interface and a valid authenticated session with any permission level, including users granted only narrow, project-scoped rights. The attacker loads the profile dropdown through the standard web UI or a direct HTTP request. Jenkins returns the menu contents without checking whether the caller holds Overall/Read. No user interaction beyond the attacker's own request is required. See the Jenkins Security Advisory 2025-09-17 for technical details on the affected component.
Detection Methods for CVE-2025-59475
Indicators of Compromise
- Authenticated HTTP requests to user profile or header dropdown endpoints from accounts lacking Overall/Read permission.
- Repeated dropdown menu requests from a single low-privilege account within a short window, indicating enumeration.
- Anomalous access patterns from service accounts or restricted users that normally interact only with specific jobs.
Detection Strategies
- Enable Jenkins access logging and correlate request paths against the permission level of the requesting user.
- Alert when accounts without Overall/Read successfully retrieve UI components that expose configuration hints.
- Compare installed plugin fingerprints across sessions to identify accounts probing for plugin presence.
Monitoring Recommendations
- Forward Jenkins controller access logs to a centralized SIEM for correlation with authentication events.
- Baseline normal request patterns per user role and flag deviations from restricted accounts.
- Monitor for scripted or headless HTTP clients targeting Jenkins UI endpoints outside of interactive browser use.
How to Mitigate CVE-2025-59475
Immediate Actions Required
- Upgrade Jenkins weekly to version 2.528 or later.
- Upgrade Jenkins LTS to version 2.516.3 or later.
- Audit user accounts and revoke unnecessary access from users who do not require Jenkins interaction.
- Review authorization strategy configuration to confirm Overall/Read is not granted implicitly to all authenticated users.
Patch Information
Jenkins addressed the missing permission check in the fixed releases identified in the Jenkins Security Advisory 2025-09-17. The fix adds the standard Overall/Read permission check to the user profile dropdown rendering path. Administrators running weekly builds should move to 2.528 or newer, and LTS operators should upgrade to 2.516.3 or newer. Additional discussion is available in the OpenWall OSS Security thread.
Workarounds
- No official workaround is documented in the vendor advisory; upgrading is the recommended remediation.
- Restrict network access to the Jenkins controller so that only trusted operators can authenticate.
- Remove or disable accounts that do not require access, reducing the population of users able to trigger the flaw.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
