CVE-2021-21639

🗓️ 07 Apr 2021 13:50:13Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 415 Views🌐 WEB

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers to replace a node with one of a different type

Reporter	Title	Published	Views	Family All 35
FreeBSD	jenkins -- multiple vulnerabilities	7 Apr 202100:00	–	freebsd
attackerkb	CVE-2021-21639	7 Apr 202114:15	–	attackerkb
AlpineLinux	CVE-2021-21639	7 Apr 202113:50	–	alpinelinux
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.222.43.0.4 / 2.249.30.0.4 / 2.277.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-04-07)	18 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (9595d002-edeb-4602-be2d-791cd654247e)	14 Apr 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.277.2 / Jenkins weekly < 2.287 Multiple Vulnerabilities	9 Apr 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)	20 May 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.8.2 (RHSA-2021:2437)	27 Jul 202100:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.7.11 (RHSA-2021:1551)	6 May 202600:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.8.2 (RHSA-2021:2437)	6 May 202600:00	–	nessus

NVD

Vulners

Node

jenkins jenkinsRange≤2.277.1lts

jenkins jenkinsRange≤2.286-

[
  {
    "product": "Jenkins",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2.286",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "LTS 2.277.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2021/04/07/2
jenkins	www.jenkins.io/security/advisory/2021-04-07/

Parameter	Position	Path	Description	CWE
body	request body	computer/{nodeName}/config.xml	Jenkins config.xml REST API endpoint vulnerability: loading submitted data for a node does not validate the object type, allowing an attacker with Computer/Configure permission to replace the node with a different type.

17 Jun 2026 03:35Current

5.6Medium risk

Vulners AI Score5.6

CVSS 24

CVSS 3.14.3

EPSS0.02725