Skip to content
Sign in
8.8 High

CVE-2024-43044 Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins…

Description

Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

Affected products and versions

Product Affected versions Fixed in
Jenkins 2.471 earliest → < 2.471 2.471
Jenkins 2.462 earliest → < 2.462.1 2.462.1
Jenkins 2.452 earliest → < 2.452.4 2.452.4

Other CVEs of Jenkins

The 153 CVEs of Jenkins →
CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Medium CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Medium CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 High CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Medium
Track this CVE