CVE-2018-1000408: Improper Authorization in Jenkins
Summary
CVE-2018-1000408: Improper Authorization in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.138.2
>= 2.140, < 2.146
Fixed in 2.138.2 or 2.146, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The Jenkins core library, specifically the 'jenkins-core' package, is responsible for the fundamental functionality of the server. This vulnerability affects Jenkins versions 2.145 and earlier, as well as LTS 2.138.1 and earlier. The vulnerability resides in the 'HudsonPrivateSecurityRealm.java' file, which handles the built-in Jenkins user database security realm.
Vulnerability Detail
The vulnerability allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm. This unauthorized access leads to the creation of an ephemeral user record in memory, resulting in a denial of service. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-285.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.138.22.138.2 -
>= 2.140, < 2.1462.146
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions mentioned above.
Conclusion
In conclusion, the CVE-2018-1000408 vulnerability in Jenkins allows unauthorized access and results in a denial of service. Users should upgrade their Jenkins installation to the recommended patched versions to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects.
The 'jenkins-core' package is the core library of Jenkins that provides fundamental functionality to the server.
The vulnerability allows unauthorized access to a specific URL, leading to a denial of service by creating ephemeral user records in memory.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, upgrade your Jenkins installation to the recommended patched versions.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
