https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:55:18.245603+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2099 BIT-jenkins-2020-2099 2026-10-07T14:55:18.252499+00:00

Affected: Bitnami: jenkins

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

 https://cve.radiocsirt.org/vuln/cnvd-2020-17200 cnvd-2020-17200 2026-10-07T14:55:18.252550+00:00 cnvd-2020-17200 https://cve.radiocsirt.org/vuln/euvd-2026-35791 EUVD-2026-35791 2026-10-07T14:55:18.252567+00:00 EUVD-2026-35791 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2099 fkie_cve-2020-2099 2026-10-07T14:55:18.252578+00:00

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

 https://cve.radiocsirt.org/vuln/ghsa-qp4f-2w67-c8hw GHSA-qp4f-2w67-c8hw — Inbound TCP Agent Protocol/3 authentication bypass in Jenkins 2026-10-07T14:55:18.252599+00:00

Affected: Maven: org.jenkins-ci.main:jenkins-core

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While [this protocol has been deprecated in 2018](https://www.jenkins.io/changelog-old/#v2.128) and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.

This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.

Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property `jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE` can be set to `true` to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.

Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.

 https://cve.radiocsirt.org/vuln/gsd-2020-2099 gsd-2020-2099 2026-10-07T14:55:18.252628+00:00 gsd-2020-2099 https://cve.radiocsirt.org/vuln/rhba-2020:0402 RHBA-2020:0402 — Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update 2026-10-07T14:55:18.252639+00:00

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking