CVE-2025-31720: Jenkins Missing Permission Check

April 2, 2025

Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.

Jenkins 2.504, LTS 2.492.3 requires Computer/Extended Read permission to copy an agent.

References

github.com/advisories/GHSA-565r-pf5q-45v6
github.com/jenkinsci/jenkins/commit/bf32018bf075c06e5df649583557c82d42d8bb5c
nvd.nist.gov/vuln/detail/CVE-2025-31720
www.jenkins.io/security/advisory/2025-04-02/

Code Behaviors & Features

Detect and mitigate CVE-2025-31720 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →