Not rated
CVE-2021-21609 Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always…
Description
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins 2.274 | earliest → 2.274 | No fix stated |
Other CVEs of Jenkins
The 153 CVEs of Jenkins →
CVE-2026-117626
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the…
4.3
Medium
CVE-2026-117625
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read…
4.3
Medium
CVE-2026-117624
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing…
8.8
High
CVE-2026-117623
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar…
5.4
Medium