Sign in
Deutsch English Español Polski
High

Jenkins Remoting library arbitrary file read vulnerability

  • Disclosed: 07.08.2024
  • Updated: 11.10.2026 12:22

Jenkins uses the Remoting library (typically agent.jar or remoting.jar) for the communication between controller and agents. This library allows agents to load classes and classloader resources from the controller, so that Java objects sent from the controller (build steps, etc.) can be executed on agents.

In addition to individual class and resource files, Remoting also allows Jenkins plugins to transmit entire jar files to agents using the Channel#preloadJar API. As of publication of this advisory, this feature is used by the following plugins distributed by the Jenkins project: bouncycastle API, Groovy, Ivy, TeamConcert

In Remoting 3256.v88a_f6e922152 and earlier, except 3206.3208.v409508a_675ff and 3248.3250.v3277a_8e88c9b_, included in Jenkins 2.470 and earlier, LTS 2.452.3 and earlier, calls to Channel#preloadJar result in the retrieval of files from the controller by the agent using ClassLoaderProxy#fetchJar. Additionally, the implementation of ClassLoaderProxy#fetchJar invoked on the controller does not restrict paths that agents could request to read from the controller file system.

This allows agent processes, code running on agents, and attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller file system.

The Remoting library in Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 now sends jar file contents with Channel#preloadJar requests, the only use case of ClassLoaderProxy#fetchJar in agents, so that agents do not need to request jar file contents from controllers anymore.

To retain compatibility with older versions of Remoting in combination with the plugins listed above, ClassLoaderProxy#fetchJar is retained and otherwise unused, just deprecated. Its implementation in Jenkins 2.471, LTS 2.452.4, LTS 2.462.1 was changed so that it is now limited to retrieving jar files referenced in the core classloader or any plugin classloader.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.jenkins-ci.main:jenkins-core < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
Java / Kotlin (Maven) org.jenkins-ci.main:remoting < 3206.3208, >= 3248, < 3248.3250, >= 3256, < 3256.3258 3206.3208, 3248.3250, 3256.3258

References

CVSS score 9/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-22, CWE-754
Platform
Java / Kotlin (Maven)
Package
org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:remoting
Disclosed
07.08.2024
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-h856-ffvv-xvr4 - CC BY 4.0

Vulnerability history: org.jenkins-ci.main:jenkins-core

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (259) in the archive
Total entries
259
First → latest
01.2022 06.2026
Without a fix
1
Exploited in attacks
4

Severity breakdown

  • Critical 19
  • High 62
  • Medium 158
  • Low 20

Disclosures per year

Severity:
  1. Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation
    High · 8.8 CVE-2026-53435 < 2.555.3, >= 2.556, < 2.568 2.555.3, 2.568
  2. Jenkins: Stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-53441 >= 2.483, < 2.568 2.568
  3. Jenkins has a link following vulnerability allows arbitrary file creation
    High · 8.8 CVE-2026-33001 < 2.555 2.555
  4. Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
    High · 7.5 CVE-2026-33002 >= 2.442, < 2.555 2.555
  5. Jenkins has a stored XSS vulnerability in node offline cause description
    High · 8.0 CVE-2026-27099 >= 2.542, < 2.551, >= 2.483, < 2.541.2 2.551, 2.541.2
  6. Jenkins has a Denial of service vulnerability in HTTP-based CLI
    High · 7.5 CVE-2025-67635 >= 2.529, < 2.541, < 2.528.3 2.541, 2.528.3
  7. Jenkins Remoting library arbitrary file read vulnerability this entry
    High · 9.0 CVE-2024-43044 < 2.452.4, >= 2.460, < 2.462.1, >= 2.470, < 2.471 2.452.4, 2.462.1, 2.471
  8. Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
    Critical · 9.8 Exploited in attacks CVE-2024-23897 >= 1.606, < 2.426.3, >= 2.427, < 2.440.1, >= 2.441, < 2.442 2.426.3, 2.440.1, 2.442
  9. Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
    High · 8.8 CVE-2024-23898 >= 2.217, < 2.426.3, >= 2.427, < 2.442, = 2.441 2.426.3, 2.442
  10. Jenkins temporary plugin file created with insecure permissions
    High · 7.0 CVE-2023-43496 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  11. Jenkins Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-43495 >= 2.50, < 2.414.2, >= 2.415, < 2.424 2.414.2, 2.424
  12. Jenkins Stored Cross-site Scripting vulnerability
    High · 8.0 CVE-2023-39151 >= 2.402, < 2.414.1, < 2.401.3, >= 2.415, < 2.416 2.414.1, 2.401.3, 2.416
  13. Jenkins CSRF protection bypass vulnerability
    High · 8.0 CVE-2023-35141 < 2.400 2.400
  14. Cross-site Scripting vulnerability in Jenkins
    High · 8.8 CVE-2023-27898 >= 2.376, < 2.394, < 2.375.4 2.394, 2.375.4
  15. Incorrect Authorization in Jenkins Core
    High · 7.0 CVE-2023-27899 >= 2.376, < 2.387.1, < 2.375.4, >= 2.388, < 2.394 2.387.1, 2.375.4, 2.394
  16. Denial of service in Jenkins Core
    High · 7.5 CVE-2023-27901 >= 2.388, < 2.394, < 2.375.4, >= 2.376, < 2.387.1 2.394, 2.375.4, 2.387.1
  17. Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
    High · 8.0 CVE-2022-41224 >= 2.367, < 2.370 2.370
  18. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34170 >= 2.350, < 2.356, >= 2.320, < 2.332.4, >= 2.346, < 2.346.1 2.356, 2.332.4, 2.346.1
  19. Unauthorized view fragment access in Jenkins
    High · 7.5 CVE-2022-34175 >= 2.335, < 2.356 2.356
  20. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34173 >= 2.340, < 2.356 2.356
  21. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34172 >= 2.340, < 2.356, >= 2.332, < 2.332.4 2.356, 2.332.4
  22. Cross-site Scripting vulnerability in Jenkins
    High · 8.0 CVE-2022-34171 >= 2.350, < 2.356, >= 2.346, < 2.346.1, < 2.332.4 2.356, 2.346.1, 2.332.4
  23. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21686 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  24. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21685 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  25. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21689 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  26. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21690 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  27. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21692 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  28. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21693 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  29. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21694 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  30. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21688 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  31. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21691 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  32. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21687 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  33. Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
    High · 8.8 CVE-2021-21696 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  34. Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
    Critical · 9.1 CVE-2021-21697 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  35. Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
    Critical · 9.0 CVE-2021-21695 < 2.303.3, >= 2.304, < 2.319 2.303.3, 2.319
  36. Session fixation vulnerability in Jenkins
    High · 7.5 CVE-2021-21671 >= 2.292, < 2.300, < 2.289.2 2.300, 2.289.2
  37. Path traversal vulnerability in Jenkins agent names
    High · 8.0 CVE-2021-21605 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  38. Improper handling of REST API XML deserialization errors in Jenkins
    High · 8.0 CVE-2021-21604 < 2.263.2, >= 2.264, < 2.275 2.263.2, 2.275
  39. Jenkins Cross-site Scripting vulnerability in project naming strategy
    High · 8.0 CVE-2020-2230 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  40. Jenkins Cross-Site Scripting vulnerability in help icons
    High · 8.0 CVE-2020-2229 < 2.235.4, >= 2.236, < 2.252 2.235.4, 2.252
  41. Stored XSS vulnerability in Jenkins 'keep forever' badge icon
    High · 8.0 CVE-2020-2222 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  42. Stored XSS vulnerability in Jenkins upstream cause
    High · 8.0 CVE-2020-2221 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  43. Stored XSS vulnerability in Jenkins job build time trend
    High · 8.0 CVE-2020-2220 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  44. Stored XSS vulnerability in Jenkins console links
    High · 8.0 CVE-2020-2223 < 2.235.2, >= 2.236, < 2.245 2.235.2, 2.245
  45. Cross-Site Request Forgery in Jenkins
    High · 8.8 CVE-2020-2160 < 2.204.6, >= 2.205, < 2.228 2.204.6, 2.228
  46. Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
    High · 8.6 CVE-2020-2099 < 2.204.2, >= 2.205, < 2.214 2.204.2, 2.214
  47. XML external entity (XXE) vulnerability in Jenkins
    High · 7.5 CVE-2015-1811 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  48. XML external entity (XXE) vulnerability in Jenkins
    High · 7.5 CVE-2015-1809 >= 1.597, < 1.600, < 1.596.1 1.600, 1.596.1
  49. Cross-Site Request Forgery in Jenkins
    High · 8.8 CVE-2019-10384 < 2.176.3, >= 2.177, < 2.192 2.176.3, 2.192
  50. Cross-Site Request Forgery in Jenkins
    High · 7.5 CVE-2019-10353 < 2.176.2, >= 2.177, < 2.186 2.176.2, 2.186
  51. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    Critical · 9.8 CVE-2017-1000362 >= 1.498, < 2.32.2, >= 2.40, < 2.44 2.32.2, 2.44
  52. Jenkins allows Execution of Code by Opening a JRMP Listener
    Critical · 9.8 CVE-2016-0788 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  53. Jenkins allows Deserialization of Untrusted Data via an XML File
    High · 8.8 CVE-2016-0792 >= 1.643, < 1.650, < 1.642.2 1.650, 1.642.2
  54. Exposure of Sensitive Information in Jenkins Core
    Critical · 9.8 CVE-2016-0791 < 1.650 1.650
  55. Jenkins affected by Open Redirect Vulnerability
    High · 7.4 CVE-2016-3726 >= 1.652, < 2.3, < 1.651.2 2.3, 1.651.2
  56. Race Condition in Jenkins
    High · 8.1 CVE-2017-1000503 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  57. Cross-Site Request Forgery in Jenkins
    High · 8.8 CVE-2017-1000356 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  58. Improper Authentication in Jenkins
    High · 8.8 CVE-2017-1000354 >= 2.50, < 2.57, < 2.46.2 2.57, 2.46.2
  59. Cross-Site Request Forgery in Jenkins
    High · 8.1 CVE-2017-1000504 >= 2.81, < 2.89.2, >= 2.90, < 2.95 2.89.2, 2.95
  60. Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
    High · 7.8 CVE-2018-1000410 < 2.138.2, >= 2.140, < 2.146 2.138.2, 2.146
Show more (20) Showing 60 of 81

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.