| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.500, < 2.504< 2.492.3 | 2.5042.492.3 |
| jenkins | < 2.492.3< 2.504 | 2.492.32.504 |
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.
This is due to an incomplete fix of SECURITY-3495/CVE-2025-27622.
Jenkins 2.504, LTS 2.492.3 requires Computer/Configure permission to copy an agent containing secrets.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free