CVE-2025-31721

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.503 and earlier Jenkins LTS versions 2.492.2 and earlier

Description A missing permission check in Jenkins allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.

Recommendations For Jenkins versions 2.503 and earlier, update to a version that includes the fix for the missing permission check. For Jenkins LTS versions 2.492.2 and earlier, update to a version that includes the fix for the missing permission check. As a temporary workaround, consider restricting access to the agent copying feature to minimize the risk of exploitation.