CVE-2025-59474

Overview

CVE-2025-59474 is a missing permission check vulnerability in Jenkins core, affecting versions 2.527 and earlier, as well as LTS 2.516.2 and earlier. The issue resides in the sidepanel of a page that is intentionally accessible to users without the Overall/Read permission. Specifically, the sidepanel's executors widget fails to enforce any permission check, allowing an attacker to list agent names [1][2].

Exploitation

An attacker with no authentication or minimal privileges (lacking Overall/Read) can access the vulnerable page and view the sidepanel. By interacting with the executors widget, they can enumerate the names of agents configured on the Jenkins instance. No additional privileges or special access is required for this information disclosure [2][3].

Impact

The primary impact is information disclosure: an attacker can learn the names of agents, which may aid in reconnaissance for further attacks. While agent names alone are not highly sensitive, they can reveal infrastructure details or be used to identify target systems for subsequent exploitation. The CVSS severity is rated Medium [1][2].

Mitigation

The vulnerability has been addressed in Jenkins versions 2.528 and LTS 2.516.3, which remove the sidepanel from the affected view. Users are strongly advised to upgrade to these or later releases. No workaround is provided for users unable to upgrade [2][3].