Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-02T16:17:29.803Z",
  "pubdate": "2026-09-02T16:17:29.803Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw within Jenkins that enables an authenticated attacker with limited agent-level permissions to perform a cross-agent configuration overwrite.\nThe issue affects Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier.\nBy manipulating the name field within an XML configuration payload submitted via the REST API or CLI, an attacker holding Agent/Configure permissions on one agent can overwrite the configuration of any other agent in the Jenkins environment.\nSuccessful exploitation results in unauthorized access to sensitive data associated with the targeted agent, including inbound agent secrets and configured environment variables.\nThis represents a significant security risk, as it allows for privilege escalation from a confined agent-specific administrative scope to a broader control over other agent nodes within the Jenkins infrastructure.\nExploitation requires the attacker to possess the Agent/Configure permission, meaning the vulnerability is not exploitable by unauthenticated users, but remains a critical risk for internal security segmentation.",
  "technicalDetails": "The vulnerability resides in the Jenkins REST API and CLI endpoints responsible for processing agent configuration updates. The root cause is a failure in the application logic to validate that the identity of the agent being updated matches the identity of the agent context to which the user is authorized.\nWhen an authorized user submits an XML configuration via the Jenkins API or CLI to update an agent they have permissions to manage, the system processes the submitted document to update the agent's internal state. Due to insufficient input validation and a lack of server-side object ownership verification, the system blindly trusts the agent name embedded within the XML payload.\nAn attacker can craft a malicious XML configuration document containing the name of a high-value or target agent. By submitting this document to the vulnerable API or CLI endpoint, the attacker forces the Jenkins master to overwrite the existing configuration record of the target agent with the malicious payload.\nThe attack flow is as follows: 1) The attacker authenticates as a user with Agent/Configure privileges for Agent A. 2) The attacker crafts an XML payload that includes the configuration details intended for Agent B. 3) The attacker submits this payload through the agent update endpoint. 4) The server parses the XML, identifies the target agent name (Agent B), and commits the configuration update to Agent B's persistent storage.\nUpon successful exploitation, the attacker gains full control over the target agent's settings. This includes the ability to modify connection parameters, command-line arguments, and environment variables. Critically, because the Jenkins master provides inbound agent secrets to agents for connection authentication, the attacker can retrieve these secrets or redirect the agent traffic to a malicious server, effectively intercepting sensitive data or injecting malicious code into the agent's build environment.\nThis vulnerability bypasses the intended security boundaries of the Jenkins permission model, which assumes that Agent/Configure permissions are scoped exclusively to the specific agent node assigned to that user or role. The lack of server-side enforcement ensures that the authorization check is performed only on the request trigger, but not on the destination resource specified within the payload, allowing an attacker to 'confuse' the server into modifying unintended objects."
}