References https://nvd.nist.gov/vuln/detail/CVE-2025-59474 https://www.jenkins.io/security/advisory/2025-09-17/ https://github.com/advisories/GHSA-67v4-38h7-9jjp https://www.miggo.io/vulnerability-database/cve/CVE-2025-59474 https://www.loginsoft.com/post/cve-2025-59474-missing-permission-check-in-jenkins-allows-unauthorized-access-to-agent-names https://medium.com/@Th3hound/exposing-jenkins-agents-without-auth-research-on-cve-2025-59474-ff95a2e7d22a https://www.acunetix.com/vulnerabilities/web/jenkins-missing-authorization-vulnerability-cve-2025-59474/ https://security.snyk.io/vuln/SNYK-RHEL10-JENKINS-12873270 https://www.xtcaq.com/nd.jsp?id=9852 https://security.zone.ci/secnews/news/473894.html
Related VulnerabilitiesJenkins 代码执行漏洞(CVE-2026-84645)PoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure DeserializationJenkins /view 文件读取漏洞(CVE-2026-53435)jenkins-unauthorized-rce: Jenkins unauthorized rcePoCCVE-2017-1000353: Jenkins CLI - Java DeserializationPoCCVE-2016-9299: Jenkins CLI - HTTP Java DeserializationPoCCVE-2018-1000600: Jenkins GitHub Plugin <=1.29.1 - Server-Side Request ForgeryPoCCVE-2018-1000861: Jenkins - Remote Command InjectionPoCCVE-2019-1003000: Jenkins Script Security Plugin <=1.49 - Sandbox BypassPoCCVE-2019-10405: Jenkins <=2.196 - Cookie ExposurePoCCVE-2019-10475: Jenkins build-metrics 1.3 - Cross-Site ScriptingPoCCVE-2020-2096: Jenkins Gitlab Hook <=1.4.2 - Cross-Site ScriptingPoCCVE-2020-2103: Jenkins <=2.218 - Information Disclosure