CVE-2017-1000354: Improper Authentication in Jenkins
Summary
CVE-2017-1000354: Improper Authentication in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.46.2
>= 2.50, < 2.57
Fixed in 2.46.2 or 2.57, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support continuous integration and delivery processes. The 'jenkins-core' package is a fundamental component of Jenkins, responsible for its core functionality. Unfortunately, versions 2.56 and earlier, as well as 2.46.1 LTS and earlier, are vulnerable to an improper authentication issue.
Vulnerability Detail
The vulnerability in Jenkins allows for an improper authentication bypass, enabling an attacker to impersonate any Jenkins user on the same instance. The 'login' command in the remoting-based CLI stored the encrypted username of the successfully authenticated user in a cache file used for further command authentication. This flaw could be exploited by users with sufficient permissions to create secrets in Jenkins and download their encrypted values. By leveraging this vulnerability, an attacker could gain unauthorized access and perform actions on behalf of other users, potentially leading to unauthorized data access, privilege escalation, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.46.22.46.2 -
>= 2.50, < 2.572.57
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Jenkins.
Conclusion
The vulnerability in Jenkins allows for improper authentication, enabling unauthorized access and potential impersonation of users. It is crucial to promptly upgrade to the fixed versions of Jenkins to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The 'jenkins-core' package is a fundamental component of Jenkins, responsible for its core functionality.
Versions 2.56 and earlier, as well as 2.46.1 LTS and earlier, are vulnerable to this issue.
By exploiting this vulnerability, an attacker can impersonate any Jenkins user on the same instance, potentially gaining unauthorized access and performing actions on behalf of other users.
To fix this vulnerability, upgrade to the recommended fixed versions of Jenkins (2.57 or later for versions 2.56 and earlier, and 2.46.2 or later for versions 2.46.1 LTS and earlier).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
