CVE-2025-31720

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.503 and earlier Jenkins LTS versions 2.492.2 and earlier

Description A missing permission check in Jenkins allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.

Recommendations For Jenkins versions 2.503 and earlier, update to a version that includes the fix for the missing permission check. For Jenkins LTS versions 2.492.2 and earlier, update to a version that includes the fix for the missing permission check. As a temporary workaround, consider restricting the Computer/Create permission to minimize the risk of exploitation.