Improper authorization in Jenkins
Priority LOW 35CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-285.
Summary
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
Why it matters now
EPSS 0.01619 76th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.main:jenkins-core (Maven): 2.159Red Hat: 1 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins | 2.158 and earlier, LTS 2.150.1 and earlier | — | No fix listed | CNA |
| — | org.jenkins-ci.main:jenkins-core (Maven) | before 2.159 | 2.159 | Patch available | GHSA-8qxp-g8jv-p37x |
- Jenkins VendorJenkins Affected 2.158 and earlier, LTS 2.150.1 and earlier Fixed in — No fix listed CNA
- org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.159 Fixed in 2.159 Patch available GHSA-8qxp-g8jv-p37x
Remediation
- Fix · GHSA-8qxp-g8jv-p37x org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.159 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.5 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Fixed | — |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1003004
- 2026-10-03 Alias added: GHSA-8qxp-g8jv-p37x
References
More Jenkins vulnerabilities
- TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-1003004 · CVE Program
- CVE-2019-1003004 · NVD
- FIRST EPSS
- GHSA-8qxp-g8jv-p37x · GitHub Advisory Database · CC BY 4.0
- CVE-2019-1003004 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences