CVE-2018-1999046: Exposure of Sensitive Information in Jenkins
Summary
CVE-2018-1999046: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.121.3
>= 2.122, < 2.138
Fixed in 2.121.3 or 2.138, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The vulnerable package in focus is org.jenkins-ci.main:jenkins-core, which is a core component of Jenkins responsible for its main functionality. This vulnerability affects Jenkins versions 2.137 and earlier, as well as 2.121.2 and earlier. The vulnerability allows attackers with Overall/Read permission to access the connection log for any agent.
Vulnerability Detail
The exposure of sensitive information vulnerability in Jenkins arises from a flaw in the Computer.java file. Attackers with Overall/Read permission can exploit this vulnerability to gain unauthorized access to the connection log of any agent. This log may contain sensitive information, potentially leading to further security breaches or unauthorized actions. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.121.32.121.3 -
>= 2.122, < 2.1382.138
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to restrict access permissions for users with Overall/Read permission. By limiting access to the connection log, the risk of unauthorized access to sensitive information can be mitigated. The following code snippet demonstrates how to restrict access to the connection log:
// Example code for restricting access to the connection log
if (user.hasPermission(Permission.OVERALL_READ)) {
// Deny access to the connection log
denyAccessToConnectionLog();
}
Conclusion
In conclusion, the exposure of sensitive information vulnerability in Jenkins allows attackers with Overall/Read permission to access the connection log for any agent. This can lead to unauthorized access to sensitive information and potential security breaches. To mitigate this vulnerability, it is recommended to upgrade Jenkins to the patched versions or apply the temporary workaround. Regularly updating Jenkins and following best security practices are essential to ensure the integrity and security of your Jenkins installation.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
This vulnerability allows attackers with Overall/Read permission to access the connection log for any agent in Jenkins. The connection log may contain sensitive information, potentially leading to further security breaches or unauthorized actions.
Users of Jenkins versions 2.137 and earlier, as well as 2.121.2 and earlier, are affected by this vulnerability. Specifically, attackers with Overall/Read permission can exploit this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
A temporary workaround is to restrict access permissions for users with Overall/Read permission. By limiting access to the connection log, the risk of unauthorized access to sensitive information can be mitigated. However, it is highly recommended to upgrade Jenkins to the patched versions mentioned earlier to fully address the vulnerability.
You can find more information about this vulnerability, including its technical details and the affected package versions, in the advisory on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-667q-vj58-rj88/GHSA-667q-vj58-rj88.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
