CVE-2020-2099 — Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

Description

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins	unspecified – ≤ 2.213, unspecified – ≤ LTS 2.204.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenShift 4	jenkins	2.204.2.1583446818-1.el7	RHBA-2020:0675
Red Hat OpenShift 3	atomic-enterprise-service-catalog +1	1:3.11.170-1.git.1.91db82e.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift +12	3.11.170-1.git.0.00cac56.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-cluster-autoscaler	3.11.170-1.git.1.0a0df6a.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-descheduler	3.11.170-1.git.1.9ad83f2.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-dockerregistry	3.11.170-1.git.1.55fab05.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-metrics-server	3.11.170-1.git.1.357f177.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-node-problem-detector	3.11.170-1.git.1.b1f90a6.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-service-idler	3.11.170-1.git.1.8328979.el7	RHBA-2020:0402
Red Hat OpenShift 3	atomic-openshift-web-console	3.11.170-1.git.1.3d64e8b.el7	RHBA-2020:0402
Red Hat OpenShift 3	cri-o	1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7	RHBA-2020:0402
Red Hat OpenShift 3	golang-github-openshift-oauth-proxy	3.11.170-1.git.1.b49be83.el7	RHBA-2020:0402
Red Hat OpenShift 3	jenkins	2.204.2.1580891656-1.el7	RHBA-2020:0402
Red Hat OpenShift 3	jenkins-2-plugins	3.11.1579107288-1.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-ansible +4	3.11.170-2.git.5.8802564.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-enterprise-autoheal	3.11.170-1.git.1.dfe6c52.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-enterprise-cluster-capacity	3.11.170-1.git.1.661684b.el7	RHBA-2020:0402
Red Hat OpenShift 3	openshift-kuryr +4	3.11.170-1.git.1.7265da1.el7	RHBA-2020:0402
Red Hat OpenShift 3	prometheus +1	3.11.170-1.git.1.227bc98.el7	RHBA-2020:0402
Red Hat OpenShift 3	prometheus-alertmanager +1	3.11.170-1.git.1.61d7960.el7	RHBA-2020:0402
Red Hat OpenShift 3	prometheus-node-exporter +1	3.11.170-1.git.1.51473b7.el7	RHBA-2020:0402

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.main:jenkins-core	< 2.204.2	2.204.2	GHSA-qp4f-2w67-c8hw
Maven	org.jenkins-ci.main:jenkins-core	>= 2.205, < 2.214	2.214	GHSA-qp4f-2w67-c8hw

Advisories 2

RHBA-2020:0402 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
RHBA-2020:0675 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.5 packages update Red Hat Security Advisories (RHSA) · Jun 27, 2026

References

https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682
[oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
RHSA-2020:0681 vendor-advisory
RHSA-2020:0683 vendor-advisory
RHBA-2020:0402 vendor-advisory
RHBA-2020:0675 vendor-advisory