jenkins: Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin

🗓️ 01 Dec 2021 12:28:59Reported by RedHatType

Jenkins vulnerability lets agent processes write to the libs directory in builds, enabling unsandboxed code execution on the controller.

Reporter	Title	Published	Views	Family All 49
FreeBSD	jenkins -- multiple vulnerabilities	4 Nov 202100:00	–	freebsd
AlpineLinux	CVE-2021-21696	4 Nov 202117:15	–	alpinelinux
ArchLinux	[ASA-202111-1] jenkins: multiple issues	5 Nov 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the FilePath API implementation in the Jenkins automation server allows a hacker to execute arbitrary code.	1 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-21696	4 Nov 202119:25	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.277.43.0.2 / 2.303.3.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-11-04)	19 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)	5 Nov 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.303.3 / Jenkins weekly < 2.319 Multiple Vulnerabilities	4 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.51 (RHSA-2021:4799)	3 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.38 (RHSA-2021:4801)	2 Dec 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins	2.303.3.1637597018-1.el8	jenkins-2.303.3.1637597018-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-21696
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21696
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2021-11-04/

21 Mar 2026 05:05Current

6.1Medium risk

Vulners AI Score6.1

CVSS 27.5

CVSS 3.19.8

EPSS0.0232