Skip to content
Threat Feed
Subscribe
critical advisory

Jenkins: Arbitrary file read via CLI @ expansion (CVE-2024-23897)

Jenkins versions prior to 2.442 and LTS 2.426.3 contain an arbitrary file read vulnerability caused by the CLI parser improperly expanding @ file references, allowing unauthenticated attackers to read contents from the Jenkins controller filesystem.

CVE search metadata

CVE search record: CVE-2024-23897. Severity: critical. CVSS: 9.8. EPSS: 100.00%. KEV: no. Product: Jenkins (< 2.442), Jenkins LTS Edition (< 2.426.3). Brief: Jenkins: Arbitrary file read via CLI @ expansion (CVE-2024-23897). Brief link: https://feed.craftedsignal.io/briefs/2026-10-jenkins-cve-2024-23897/

Triage facts

Revision 1
Applicability
Jenkins (< 2.442), Jenkins LTS Edition (< 2.426.3)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 25, 12:41 UTC
Vulnerabilities
1 CVE
Source quality
A1Very likely

Jenkins controller instances are vulnerable to an arbitrary file read vulnerability (CVE-2024-23897) due to a feature in the Jenkins CLI parser that replaces an '@' character followed by a file path with the content of that file. This feature is enabled by default and does not require authentication. The impact varies based on attacker permissions: users with Overall/Read permission can read full files, while unauthenticated users can read the first few lines of files depending on the CLI commands available. Public exploit code for this vulnerability is currently available.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive files from the Jenkins controller filesystem. This may lead to the exposure of credentials, environment variables, configuration files, or other sensitive system data.

Recommendation

  • Upgrade Jenkins to version 2.442 or later, or Jenkins LTS to 2.426.3 or later, immediately to disable the vulnerable CLI expansion feature.
  • If patching is not immediately feasible, restrict access to the Jenkins CLI and HTTP endpoints to trusted networks only.
  • Review Jenkins access logs for anomalous requests to the CLI endpoint.

Immediate actions

Patch all Jenkins instances to the latest secure version (2.442 or 2.426.3 LTS).

IT Operations 24h

Threat Hunt

Search access logs for suspicious Jenkins CLI requests containing the @ symbol.

T1190 high high confidence hunt now

Data: Jenkins access logs / HTTP web server logs

Mitigations

Disable public access to Jenkins CLI port or implement strict IP filtering.

immediate IT Operations

CVE-2024-23897