Security Flaw in Jenkins Affects Agent Configuration Access

CVE-2025-31721

What is CVE-2025-31721?

A missing permission check in earlier versions of Jenkins allows users with specific permissions to exploit the system. Attackers with 'Computer/Create' permissions can copy an agent without having 'Computer/Configure' permissions, thereby gaining unauthorized access to encrypted secrets stored in the agent’s configuration. This vulnerability emphasizes the importance of strict access control measures to protect sensitive information within Jenkins environments.

References