CVE-2019-1003049: Insufficient Session Expiration in Jenkins
Summary
CVE-2019-1003049: Insufficient Session Expiration in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.164.2
>= 2.165, < 2.172
Fixed in 2.164.2 or 2.172, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of plugins and integrations to support various development processes. The 'jenkins-core' package is a fundamental component of Jenkins, responsible for its core functionality.
Vulnerability Detail
The vulnerability identified as CVE-2019-1003049 in the 'jenkins-core' package allows users who cached their CLI authentication before Jenkins was updated to certain versions to remain authenticated in vulnerable versions. This issue arises due to an insufficient session expiration mechanism. Specifically, the fix for CVE-2019-1003004 in Jenkins 2.171 and earlier, as well as Jenkins LTS 2.164.1 and earlier, did not reject existing remoting-based CLI authentication caches. As a result, authenticated users may continue to have access to Jenkins even after the fix is applied, potentially leading to unauthorized actions and data breaches.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.164.22.164.2 -
>= 2.165, < 2.1722.172
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the 'jenkins-core' package to a secure version.
Conclusion
The vulnerability identified as CVE-2019-1003049 in the 'jenkins-core' package allows authenticated users to remain logged in to Jenkins, potentially leading to unauthorized actions and data breaches. To mitigate this risk, it is essential to update the 'jenkins-core' package to version 2.164.2 or newer. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for building, testing, and deploying software projects. It provides a wide range of features and integrations to support continuous integration and delivery processes.
The 'jenkins-core' package is a fundamental component of Jenkins, responsible for its core functionality. It includes essential features and APIs used by other plugins and extensions.
This vulnerability allows authenticated users to remain logged in to Jenkins even after applying certain security fixes. This can lead to unauthorized access and potential data breaches, compromising the integrity and confidentiality of the Jenkins instance.
To fix this vulnerability, update the 'jenkins-core' package to version 2.164.2 or newer. This update includes the necessary changes to reject existing remoting-based CLI authentication caches.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the 'jenkins-core' package.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
