NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

CVE-2021-21609 — jenkins-core

MEDIUMFix: jenkinsci/jenkins@fe9091f

CVE-2021-21609 is a medium-severity (CVSS 5.3) CWE-863 vulnerability in org.jenkins-ci.main:jenkins-core. A fix is available for org.jenkins-ci.main:jenkins-core — see the affected versions and patch details below.

Missing permission check for paths with specific prefix in Jenkins

Also known asBIT-jenkins-2021-21609GHSA-4625-q52w-39cx
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs71th percentile — riskier than 71% of all scored CVEsHighest risk
0.00%0.61%1.22%1.82%0.1%1.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
☕org.jenkins-ci.main:jenkins-core☕org.jenkins-ci.main:jenkins-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list.

This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required:

  • accessDenied
  • error
  • instance-identity
  • login
  • logout
  • oops
  • securityRealm
  • signup
  • tcpSlaveAgentListener

For example, a plugin contributing the path loginFoo/ would have URLs in that space accessible without the default Overall/Read permission check.

The Jenkins security team is not aware of any affected plugins as of the publication of this advisory.

The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2.

In case this change causes problems, additional paths can be made accessible without Overall/Read permissions: The Java system property jenkins.model.Jenkins.additionalReadablePaths is a comma-separated list of additional path prefixes to allow access to.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.jenkins-ci.main:jenkins-coreall versions2.263.2org.jenkins-ci.main:jenkins-core:2.263.2
☕Mavenorg.jenkins-ci.main:jenkins-core≥ 2.264&&< 2.2752.275org.jenkins-ci.main:jenkins-core:2.275

Affected Products

1 product · 2 configurations
Application
jenkinsjenkins
≤ 2.274
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.jenkins-ci.main:jenkins-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.jenkins-ci.main:jenkins-core to 2.263.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-21609 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatLow
ProductFixed inAdvisory
Red Hat OpenShift Container Platform 3.11jenkins-0:2.263.3.1612433584-1.el7RHSA-2021:0637
Red Hat OpenShift Container Platform 4.5conmon-2:2.0.21-1.rhaos4.5.el7RHSA-2021:0429
Red Hat OpenShift Container Platform 4.6jenkins-0:2.263.3.1612434510-1.el8RHSA-2021:0423
Red Hat OpenShift Container Platform 4.8atomic-openshift-service-idler-0:4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8RHSA-2021:2437

Frequently Asked Questions

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list. This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required: - `accessDenied` - `error` - `instance-identity` - `login` - `logout` - `oops` - `securityRealm` - `signup` - `tcpSlaveAgentListener`
O3 Security · Impact-Aware SCA

Is CVE-2021-21609 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2021-21609: jenkins-core — Fixed in 2.263.2