Description

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T16:17:30.273Z",
  "pubdate": "2026-09-02T16:17:30.273Z",
  "executiveSummary": "This vulnerability is an improper access control flaw within Jenkins that leads to unauthorized information disclosure.\nThe vulnerability allows an authenticated attacker possessing 'Item/Read' permission on a single job to bypass authorization constraints and access sensitive build parameter names and values across other jobs for which they lack appropriate permissions.\nAffected products include Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier.\nThe risk implication is significant as build parameters often contain sensitive data such as credentials, API keys, tokens, or configuration secrets that could be leveraged for further attacks or privilege escalation within the CI/CD pipeline.\nExploitation requires the attacker to hold legitimate 'Item/Read' permissions on at least one Jenkins job, meaning the attacker must be an authenticated user within the environment, though they do not require administrative privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in a missing or improperly implemented authorization check within the Jenkins job parameter handling mechanism. In affected versions, the application fails to validate the user's 'Item/Read' permission against the specific scope of the target job when querying build parameter configurations.\nThe vulnerable component involves the Jenkins API or web interface endpoints responsible for retrieving job build parameter data. When a user queries these parameters, the system incorrectly evaluates authorization, allowing requests to return data for jobs that should be restricted based on the attacker's assigned permissions.\nThe attack flow proceeds as follows: First, the attacker must have valid credentials and at least 'Item/Read' permission on a single, non-restricted job. Second, the attacker crafts a request to the Jenkins instance—typically via the REST API or XML/JSON API endpoints—targeting the build parameters of a job for which they are not authorized. Third, because the authorization logic is bypassed, the Jenkins server processes the request and returns the parameter names and their current values in the response body.\nThis exposure is critical because build parameters frequently contain sensitive information. If a build parameter is configured with a 'Secret' type or contains embedded credentials, these are inadvertently leaked to unauthorized users. An attacker can systematically enumerate build parameters across the entire Jenkins instance to extract these credentials.\nPost-exploitation, the attacker can leverage the discovered secrets to gain unauthorized access to external systems, repositories, or services integrated into the CI/CD pipeline. This facilitates lateral movement, potential code execution, or further compromise of the development environment. The vulnerability resides within the core Jenkins authorization framework, specifically affecting how job objects validate access to parameter metadata during client-side requests. The flaw is not limited to specific plugins but is inherent to the Jenkins controller's job management logic in the specified versions."
}