CVE-2023-28668: Jenkins Role-based Authorization Strategy Plugin Grants Permissions Even After They've Been Disabled
Summary
CVE-2023-28668: Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled. Affects org.jenkins-ci.plugins:role-strategy versions < 587.588.v850a_20a_30162. Fixed in 587.588.v850a_20a_30162. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Role-based Authorization Strategy Plugin is a plugin for the Jenkins automation server that provides role-based access control for users and groups. It allows administrators to define roles and assign permissions to those roles, controlling what actions users can perform within Jenkins. The plugin is widely used in Jenkins installations to enforce security policies and restrict access to sensitive operations and resources.
Vulnerability Detail
The Role-based Authorization Strategy Plugin in versions 587.v2872c41fa_e51 and earlier has a vulnerability that allows permissions to be granted even after they have been disabled. Normally, permissions in Jenkins can be enabled or disabled, with some permissions being disabled by default. However, this plugin fails to properly enforce the disabling of permissions, allowing attackers to retain access to certain actions and resources even after those permissions have been disabled. This can lead to unauthorized access and potential misuse of Jenkins functionality.
How To Fix
Latest published version: 928.vc60b_edb_fea_e1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
587.588.v850a_20a_30162
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version of the plugin is the recommended solution.
Conclusion
The Jenkins Role-based Authorization Strategy Plugin has a vulnerability that allows permissions to be granted even after they have been disabled. This can lead to unauthorized access and potential misuse of Jenkins functionality. To fix this vulnerability, it is recommended to upgrade to the latest version of the plugin. For further support and assistance, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:role-strategy →
FAQ
This vulnerability allows attackers to retain access to certain actions and resources in Jenkins even after those permissions have been disabled. It can lead to unauthorized access and potential misuse of Jenkins functionality.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for any open-source vulnerabilities, including this one.
There are currently no known exploits for this vulnerability. However, it is important to patch your Jenkins installation as soon as possible to prevent any potential unauthorized access.
While it is possible to manually disable the affected permissions, this will not fully mitigate the vulnerability. The plugin fails to properly enforce the disabling of permissions, so it is recommended to upgrade to the fixed version of the plugin instead.
For further support on vulnerability remediation and assistance with upgrading the Role-based Authorization Strategy Plugin, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:role-strategy.
