CVE-2025-31721: Jenkins Missing Permission Check

April 2, 2025

Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.

This is due to an incomplete fix of SECURITY-3495/CVE-2025-27622.

Jenkins 2.504, LTS 2.492.3 requires Computer/Configure permission to copy an agent containing secrets.

References

github.com/advisories/GHSA-wr6w-jxg7-qpfh
github.com/jenkinsci/jenkins/commit/b3651b475302e8dba20fc63c1ff89d144ec652f0
nvd.nist.gov/vuln/detail/CVE-2025-31721
www.jenkins.io/security/advisory/2025-04-02/

Code Behaviors & Features

Detect and mitigate CVE-2025-31721 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →