CVE-2017-2603: User Data Leak in Jenkins
Summary
CVE-2017-2603: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.32.2
>= 2.34, < 2.44
Fixed in 2.32.2 or 2.44, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The vulnerable package in this case is org.jenkins-ci.main:jenkins-core.
Vulnerability Detail
Jenkins versions before 2.44 and 2.32.2 are susceptible to a user data leak in the config.xml API of disconnected agents. This vulnerability, identified as SECURITY-362, allows unauthorized actors to access sensitive information, including API tokens. The leak occurs due to a flaw in the handling of disconnected agents' configuration files.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.32.22.32.2 -
>= 2.34, < 2.442.44
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the config.xml API for disconnected agents. This can be achieved by modifying the Jenkins configuration file and removing or commenting out the relevant configuration options. However, this workaround may limit the functionality of disconnected agents.
Conclusion
In conclusion, Jenkins versions before 2.44 and 2.32.2 are vulnerable to a user data leak in the config.xml API of disconnected agents. It is crucial to upgrade Jenkins to the recommended versions or apply the provided workaround to mitigate the risk of sensitive information exposure. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The vulnerable package is org.jenkins-ci.main:jenkins-core.
This vulnerability can lead to the exposure of sensitive information, such as API tokens, to unauthorized actors.
To fix this vulnerability, upgrade Jenkins to version 2.44 or 2.32.2.
Yes, a temporary workaround is to disable the config.xml API for disconnected agents.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
