CVE-2018-1999004: Incorrect Authorization in Jenkins
Summary
CVE-2018-1999004: Incorrect Authorization in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.2
>= 2.122, < 2.132
Fixed in 2.121.2 or 2.132, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development workflows. The Jenkins Core package, specifically versions 2.132 and earlier, 2.121.1 and earlier, is affected by an improper authorization vulnerability. This vulnerability resides in the SlaveComputer.java file and allows attackers with Overall/Read permission to initiate and abort agent launches.
Vulnerability Detail
The vulnerability arises from a flaw in the authorization mechanism of Jenkins. Attackers with Overall/Read permission can exploit this vulnerability to launch and abort agent processes. This unauthorized access can lead to various security risks, including unauthorized execution of code on Jenkins agents and potential compromise of the Jenkins server. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.22.121.2 -
>= 2.122, < 2.1322.132
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict Overall/Read permission to trusted individuals only. By limiting access to this permission, the risk of unauthorized agent launches and aborts can be mitigated. However, this workaround may impact the functionality and collaboration capabilities of Jenkins.
Conclusion
The vulnerability in Jenkins Core (versions 2.132 and earlier, 2.121.1 and earlier) allows attackers with Overall/Read permission to initiate and abort agent launches. This can lead to unauthorized code execution on Jenkins agents and compromise of the Jenkins server. It is crucial to upgrade to the fixed versions (2.121.2 or 2.132) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability allows attackers with Overall/Read permission to initiate and abort agent launches, potentially leading to unauthorized code execution on Jenkins agents and compromise of the Jenkins server.
Users of Jenkins versions 2.132 and earlier, 2.121.1 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, fixed versions of Jenkins Core are available. Users should upgrade to version 2.121.2 for versions 2.121.1 and earlier, and version 2.132 for versions 2.132 and earlier.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
