products / jenkins

Jenkins

Jenkins is a widely deployed automation server with a large plugin surface. NVD uses jenkins:jenkins as the canonical application CPE. Historical CloudBees-prefixed CPE rows deprecate to this namespace.

api usage

Querying Jenkins

product slugjenkins

version format2.441, 2.426.3

bash

curl "https://api.attestd.io/v1/check?product=jenkins&version=2.441" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Weekly release 2.441 falls before the 2.442 fix for CVE-2024-23897 (CVSS 9.8, CISA KEV): an arbitrary file read via the CLI / args4j @ file expansion, heavily abused in ransomware campaigns.

json

{
  "product": "jenkins",
  "version": "2.441",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2024-23897",
    "CVE-2024-23898",
    "CVE-2024-43044",
    "CVE-2024-43045",
    "CVE-2024-47803",
    "CVE-2024-47804",
    "CVE-2025-27622",
    "CVE-2025-27623",
    "CVE-2025-27624",
    "CVE-2025-27625",
    "CVE-2025-31720",
    "CVE-2025-31721",
    "CVE-2025-59474",
    "CVE-2025-59475",
    "CVE-2025-59476",
    "CVE-2025-67635",
    "CVE-2025-67636",
    "CVE-2025-67637",
    "CVE-2025-67638",
    "CVE-2025-67639",
    "CVE-2026-27100",
    "CVE-2026-33001",
    "CVE-2026-33002",
    "CVE-2026-53435",
    "CVE-2026-53436",
    "CVE-2026-53437",
    "CVE-2026-53438",
    "CVE-2026-53439",
    "CVE-2026-53440",
    "CVE-2026-53442",
    "CVE-2026-57281",
    "CVE-2026-70442",
    "CVE-2026-70446"
  ],
  "cves": null,
  "max_epss": 0.99999,
  "last_updated": "2026-08-05T21:40:39.733231Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

patched line

2.450 is a representative weekly release after the 2.442 security fix window. Always confirm against your exact LTS train (for example 2.426.3+) in NVD ranges.

bash

curl "https://api.attestd.io/v1/check?product=jenkins&version=2.450" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

CVE	Description	Affects	CVSS
`CVE-2024-23897`KEV	Arbitrary file read via CLI (CISA KEV).	Jenkins weekly/LTS before Jan 2024 patches	9.8
`CVE-2024-23898`	CSRF cross-domain WebSocket leak (paired fix).	paired fix	8.8
`CVE-2023-27898`	JSONP user search endpoint exposure.	see NVD	8.8

All products GitLab Tekton Response Field Reference