CVE-2019-10353: Cross-Site Request Forgery in Jenkins
Summary
CVE-2019-10353: Cross-Site Request Forgery in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.176.2
>= 2.177, < 2.186
Fixed in 2.176.2 or 2.186, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry and provides a range of features for continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
The vulnerability identified as CVE-2019-10353 is a Cross-Site Request Forgery (CSRF) issue in Jenkins. In versions 2.185 and earlier, as well as LTS 2.176.1 and earlier, CSRF tokens did not expire, allowing attackers who obtained these tokens to bypass CSRF protection. This vulnerability could potentially lead to unauthorized actions being performed on behalf of authenticated users, compromising the integrity and security of the Jenkins instance.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.176.22.176.2 -
>= 2.177, < 2.1862.186
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to manually invalidate the existing CSRF tokens by restarting the Jenkins instance. This will force all users to obtain new tokens, effectively mitigating the CSRF vulnerability. However, this is only a temporary solution, and upgrading to the fixed versions is still necessary for complete protection.
Conclusion
The CVE-2019-10353 vulnerability in Jenkins exposes a potential security risk through CSRF attacks. It is crucial to upgrade to the fixed versions mentioned or apply the temporary workaround to mitigate the risk. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery in software development projects.
Cross-Site Request Forgery (CSRF) is a type of security vulnerability that allows an attacker to perform unauthorized actions on behalf of authenticated users.
An attacker who obtains a valid CSRF token can trick an authenticated user into performing unintended actions without their knowledge or consent.
This vulnerability could lead to unauthorized actions being performed on the Jenkins instance, compromising the integrity and security of the software projects being developed and deployed.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. It provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
