Description
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
Remediation
References
Related Vulnerabilities
Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-33704)
WordPress Plugin Skysa App Bar Integration 'submit' Parameter Cross-Site Scripting (1.03)
Apache HTTP Server Other Vulnerability (CVE-2010-1452)
WordPress Plugin Advanced WP Columns Cross-Site Scripting (2.0.6)
XWiki Incorrect Authorization Vulnerability (CVE-2023-46244)