Description
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.462.3.1729837947-3.el8 | RHSA-2024:8887, RHSA-2024:8886, RHSA-2024:8885 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1730119231-1.el8 | RHSA-2024:8887, RHSA-2024:8886, RHSA-2024:8885 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.462.3 | 2.462.3 | GHSA-f9qj-77q2-h5c5 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.466, < 2.479 | 2.479 | GHSA-f9qj-77q2-h5c5 |
Advisories 7
- RHSA-2024:8886 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:8887 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:8884 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:8885 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2024-3071 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2024
References
- Jenkins Security Advisory 2024-10-02 vendor-advisory