| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:swarm | < 3.21 | 3.21 |
| self-organizing swarm modules | ≤ 3.20 |
Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent.
Swarm Plugin 3.21 requires Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free