CVE-2018-1000068: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Summary
CVE-2018-1000068: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.89.4
>= 2.90, < 2.107
Fixed in 2.89.4 or 2.107, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and features to support continuous integration and delivery. The vulnerability identified as CVE-2018-1000068 affects Jenkins versions 2.106 and earlier, as well as LTS 2.89.3 and earlier. This vulnerability allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.
Vulnerability Detail
The vulnerability arises from an improper input validation issue in Jenkins. Attackers can exploit this vulnerability to gain unauthorized access to sensitive plugin resource files. This can lead to the exposure of confidential information, such as credentials or configuration files, which may be stored in these directories. The vulnerability is considered moderate, with a CVSS score of 5.3. It can be particularly impactful if the Jenkins home directory is located on a case-insensitive file system.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.89.42.89.4 -
>= 2.90, < 2.1072.107
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually restrict access to the META-INF and WEB-INF directories in their Jenkins installation. This can be achieved by adjusting the file system permissions or configuring access control rules to prevent unauthorized access. However, applying the recommended fix by upgrading to the latest stable release is the most effective solution.
Conclusion
The vulnerability identified as CVE-2018-1000068 in Jenkins exposes sensitive information to unauthorized actors. It is crucial to upgrade to the recommended versions or apply the workaround to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects. It provides a wide range of plugins and features to support the development process.
The vulnerability allows unauthorized access to sensitive plugin resource files, potentially exposing confidential information stored in these directories.
Jenkins versions 2.106 and earlier, as well as LTS 2.89.3 and earlier, are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Jenkins to version 2.89.4 or later if using versions 2.89.3 or earlier. For versions 2.106 and earlier, upgrading to version 2.107 or later is advised.
Yes, users can manually restrict access to the META-INF and WEB-INF directories in their Jenkins installation. Adjusting file system permissions or configuring access control rules can help prevent unauthorized access.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
