CVE-2025-59474: Jenkins has a missing permission check, allowing users to obtain agent names

September 17, 2025 (updated November 5, 2025)

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission.

This allows attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

Jenkins 2.528, LTS 2.516.3 removes the sidepanel from the affected view.

References

github.com/advisories/GHSA-67v4-38h7-9jjp
nvd.nist.gov/vuln/detail/CVE-2025-59474
www.jenkins.io/security/advisory/2025-09-17/

Code Behaviors & Features

Detect and mitigate CVE-2025-59474 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →