CVE-2019-10471: Jenkins Libvirt Slaves Plugin Cross-Site Request Forgery
Summary
CVE-2019-10471: Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery. Affects org.jenkins-ci.plugins:libvirt-slave versions < 1.8.6. Fixed in 1.8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Libvirt Slaves Plugin is a Maven package that provides functionality for managing virtual machine slaves in a Jenkins environment. It allows users to connect to virtual machines using the libvirt API. This plugin is vulnerable to a cross-site request forgery (CSRF) attack, which can be exploited by attackers to connect to an SSH server of their choice using credentials obtained through another method. This can lead to unauthorized access and the capture of sensitive credentials stored in Jenkins.
Vulnerability Detail
The vulnerability in Jenkins Libvirt Slaves Plugin arises from a lack of proper CSRF protection. Attackers can trick authenticated users into performing unintended actions on the plugin, such as connecting to an attacker-specified SSH server. By obtaining credentials IDs through another method, attackers can bypass authentication and gain unauthorized access to SSH servers. This can result in the compromise of sensitive information stored in Jenkins, including credentials. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 325.ve30f881b_95c9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the Jenkins Libvirt Slaves Plugin to the latest version.
Conclusion
The Jenkins Libvirt Slaves Plugin is vulnerable to a cross-site request forgery attack, allowing attackers to connect to SSH servers using unauthorized credentials. This can result in unauthorized access and the capture of sensitive information stored in Jenkins. It is crucial to update the plugin to the latest version to mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:libvirt-slave →
FAQ
The vulnerability allows attackers to connect to SSH servers using unauthorized credentials, potentially leading to unauthorized access and the capture of sensitive information stored in Jenkins.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There are no known public exploits for this vulnerability at the time of this report. However, it is essential to apply the recommended fix to mitigate the risk of exploitation.
Yes, this vulnerability can be exploited remotely. Attackers can craft malicious requests and trick authenticated users into performing unintended actions, leading to unauthorized access to SSH servers.
Yes, a patch is available for this vulnerability. Users should upgrade the Jenkins Libvirt Slaves Plugin to version 1.8.6 or later to fix the issue.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:libvirt-slave.
