# Jenkins Security: Advisories, CVEs, and Hardening - URL: https://karandeepsingh.ca/posts/jenkins-security-advisories-and-cves/ - Author: Karandeep Singh - Published: 2024-02-01 - Updated: 2026-06-27 - Series: Running Jenkins - Tags: jenkins - Summary: Jenkins security evolution, the CVE-2024-23897 CLI vulnerability, and keeping plugins patched to shrink the attack surface. ![Close-up of a computer motherboard representing Jenkins build infrastructure](https://karandeepsingh.ca/images/posts/jenkins-versions.jpg) Security has moved to the center of Jenkins development, with each major version adding new defenses. This guide traces that evolution, examines the critical CVE-2024-23897 CLI vulnerability, and explains why plugin hygiene is now the dominant risk. ## Security Evolution Across Jenkins Versions Security has become increasingly central to Jenkins development, with each major version bringing important enhancements. ### Security Features by Version | Jenkins Version | Security Features Added | |-----------------|-------------------------| | 2.0+ | CSRF protection, secure defaults | | 2.138 (2018) | Introduction of Content Security Policy | | 2.150+ | Agent-to-controller security, script security | | 2.176 (2019) | Separation of Overall/Administer permissions | | 2.200+ | Pipeline sandbox improvements | | 2.250+ | Password hashing enhancements | | 2.300+ | Content-Security-Policy implementation | | 2.303 (2021) | Built-in brute force protection | | 2.350+ | Cross-site request forgery improvements | | 2.361 (2022) | Java 11 requirement enabling modern security libraries | | 2.400+ | Enhanced authentication options | | 2.442 / 2.426.3 LTS (Jan 2024) | Fix for CVE-2024-23897 (CLI arbitrary file read) and CVE-2024-23898 (CLI WebSocket CSWSH) | | 2.463 (2024) | Java 17 requirement, dropping Java 11 | | 2.541 (2025-2026) | bcrypt password length enforcement, new repository signing keys | | 2.555.1 LTS (2026) | Java 21 required (Java 17 dropped), Java 25 supported | ### Security Milestone Timeline ```mermaid timeline title Jenkins Security Evolution 2016 : Jenkins 2.0 Release : CSRF Protection
Agent Security 2018 : Content Security Policy : Cross-Site Scripting Protection 2019 : Permission Segregation : Granular Authorization 2020 : Secret Obfuscation : Credential Protection 2021 : Brute Force Protection : Authentication Security 2022 : Java 11 Required : Modern Security Libraries 2023 : Pipeline Sandbox Improvements : Script Security 2024 : CVE-2024-23897 CLI Fix : Java 17 Required
Java 11 Dropped 2025 : New Repo Signing Keys : bcrypt Password Length Enforcement 2026 : Java 21 Required (LTS 2.555.1) : Java 17 Dropped
Java 25 Supported ``` ### Case Study: CVE-2024-23897 (CLI Arbitrary File Read) One of the most consequential core vulnerabilities in recent Jenkins history was [CVE-2024-23897](https://www.jenkins.io/security/advisory/2024-01-24/), disclosed in the Jenkins Security Advisory of January 24, 2024 and rated **Critical**. Jenkins' built-in CLI uses the args4j library, whose `expandAtFiles` feature replaces an argument of the form `@` followed by a file path with the contents of that file. Because the feature was enabled by default, an attacker could supply such an argument to read **arbitrary files on the controller** — and under some conditions chain that primitive toward remote code execution. - **Affected**: Jenkins weekly 2.441 and earlier, and LTS 2.426.2 and earlier - **Fixed in**: Jenkins 2.442 and LTS 2.426.3, where the fix disables the `expandAtFiles` feature The same advisory also covered [CVE-2024-23898](https://www.jenkins.io/security/advisory/2024-01-24/) (High), in which the CLI WebSocket endpoint lacked origin validation, allowing cross-site WebSocket hijacking (CSWSH). ### Where the Risk Lives Now: Plugins, Not Core Through 2025, the Jenkins project continued to publish [security advisories](https://www.jenkins.io/security/advisories/) roughly monthly, but the picture shifted in an important way: the **majority of Critical and High severity issues were in plugins, not Jenkins core** (examples include an OAuth/OIDC authentication-bypass class of issues and a Templating Engine sandbox bypass). The takeaway is that core has hardened considerably, so **plugin hygiene is now the dominant security risk**: update plugins promptly when fixes ship, and remove plugins you no longer use to shrink the attack surface. ### Security Best Practices #### Authentication and Authorization - **Security Realm**: LDAP/AD integration for enterprise - **Authorization Strategy**: Role-based access control - **API Tokens**: Limited-scope tokens for automation - **Matrix-based Security**: Fine-grained permissions - **SAML/OAuth**: Modern SSO integration #### Network Security - **Reverse Proxy**: TLS termination with Nginx/Apache - **Agent Communication**: Encrypted protocols - **Firewall Rules**: Control access to controller/agents - **Internal Network**: Place in secure network zone - **VPN Access**: Restrict remote access #### Build Environment Security - **Pipeline Sandbox**: Script approval process - **Secrets Management**: Credentials plugin usage - **Container Security**: Unprivileged containers - **Read-only Filesystems**: Where possible - **Principle of Least Privilege**: Minimal permissions This article is part of the [Jenkins LTS vs Weekly guide](https://karandeepsingh.ca/posts/comprehensive-guide-to-jenkins-versions/). **Question:** When a plugin security advisory ships, how quickly can your team patch the affected plugins in production? ## References - Jenkins Security Team. (2024). [Jenkins Security Advisory 2024-01-24 (CVE-2024-23897, CVE-2024-23898)](https://www.jenkins.io/security/advisory/2024-01-24/). Jenkins Security Project. - Jenkins Security Team. (2026). [Jenkins Security Advisories](https://www.jenkins.io/security/advisories/). Jenkins Security Project.