NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

CVE-2024-23898 — jenkins-core

HIGHFix: jenkinsci/jenkins@de45096

CVE-2024-23898 is a high-severity (CVSS 8.8) CWE-346 vulnerability in org.jenkins-ci.main:jenkins-core. EPSS puts its 30-day exploitation probability at 67.2% (99th percentile). A fix is available for org.jenkins-ci.main:jenkins-core — see the affected versions and patch details below.

Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

Also known asBIT-jenkins-2024-23898GHSA-53ph-2r2x-vqw8
Published
Updated
Affected
3 pkgs
Patched
2 / 3
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-23898.

EPSS Exploitation Probability

via FIRST.org ↗
67.2%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
27.8%43.9%60.1%76.2%36.9%67.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected
☕org.jenkins-ci.main:jenkins-core☕org.jenkins-ci.main:jenkins-core☕org.jenkins-ci.main:jenkins-core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war.

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.

Affected Packages

3 total 2 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.jenkins-ci.main:jenkins-core≥ 2.217&&< 2.426.32.426.3org.jenkins-ci.main:jenkins-core:2.426.3
☕Mavenorg.jenkins-ci.main:jenkins-core≥ 2.427&&< 2.4422.442org.jenkins-ci.main:jenkins-core:2.442
☕Mavenorg.jenkins-ci.main:jenkins-coreall versionsNo fix

Affected Products

1 product · 2 configurations
Application
jenkinsjenkins
≥ 2.222.1 && ≤ 2.426.2
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.jenkins-ci.main:jenkins-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.jenkins-ci.main:jenkins-core to 2.426.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-23898 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
ProductFixed inAdvisory
OCP-Tools-4.12-RHEL-8jenkins-0:2.426.3.1706515686-3.el8RHSA-2024:0778
OCP-Tools-4.13-RHEL-8jenkins-0:2.426.3.1706516254-3.el8RHSA-2024:0776
OpenShift Developer Tools and Services for OCP 4.11jenkins-0:2.426.3.1706516929-3.el8RHSA-2024:0775

Frequently Asked Questions

Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenki
O3 Security · Impact-Aware SCA

Is CVE-2024-23898 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-23898: jenkins-core — Fixed in 2.426.3