Every CVE Search/ Get API key

CVE-2021-21697

Agent-to-controller access control allows reading/writing most content of build directories in Jenkins

9.1 CriticalFix available

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.60%Up 1.0 points since Nov 5, 2021
90%50%10%1%

What each source reports

NVD Score used 9.1

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

Record
CVE-2021-21697
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:P/A:N
Updated
2026-11-02
CVE List No score

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

Record
CVE-2021-21697
Updated
2026-11-02
EUVDEUVD-2022-3632 No score

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

Record
EUVD-2022-3632
Updated
2026-11-03
GitHub AdvisoriesGHSA-cv2w-q8c3-xjv7 9.1

Agent-to-controller access control allows reading/writing most content of build directories in Jenkins

Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata).

Jenkins 2.319, LTS 2.303.3 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory.

Update Pipeline: Nodes and Processes to version 2.40 or newer for Jenkins to associate Pipeline node blocks with the agent they’re running on for this fix.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.

Record
GHSA-cv2w-q8c3-xjv7
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-184
Updated
2026-11-02
OSV 9.1

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

Record
CVE-2021-21697
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-cv2w-q8c3-xjv7 9.1

Agent-to-controller access control allows reading/writing most content of build directories in Jenkins

Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata).

Jenkins 2.319, LTS 2.303.3 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory.

Update Pipeline: Nodes and Processes to version 2.40 or newer for Jenkins to associate Pipeline node blocks with the agent they’re running on for this fix.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.

Record
GHSA-cv2w-q8c3-xjv7
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-184
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2021:4799 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.6.51 packages and security update

Record
RHSA-2021:4799
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4801 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.7.38 security update

Record
RHSA-2021:4801
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4827 9.0

Red Hat Security Advisory: OpenShift Container Platform 3.11.569 security update

Record
RHSA-2021:4827
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4829 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.8.22 security update

Record
RHSA-2021:4829
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4833 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.9.9 security update

Record
RHSA-2021:4833
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0055 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update

Record
RHSA-2022:0055
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-jenkins-2021-21697 No score

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.

Record
BIT-jenkins-2021-21697
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 2.304 to 2.318
2.319
org.jenkins-ci.main:jenkins-core
Maven
 through 2.303.2
2.303.3
jenkins
Bitnami
 before 2.318.1
2.318.1
org.jenkins-ci.main:jenkins-core
Maven
 before 2.303.3, plus listed versions
1.3961.3971.3981.3991.400
Show 45 moreShow less
1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437
2.303.3
org.jenkins-ci.main:jenkins-core
Maven
 2.304 up to 2.319, plus listed versions
2.3052.3062.3072.3082.309
Show 8 moreShow less
2.3112.3122.3132.3142.3152.3162.3172.318
2.319
jenkins
Red Hat:openshift:4.6::el8
From an advisory covering 14 CVEs
 before 0:2.303.3.1637597493-1.el8
0:2.303.3.1637597493-1.el8
jenkins-2-plugins
Red Hat:openshift:4.6::el8
From an advisory covering 14 CVEs
 before 0:4.6.1637602169-1.el8
0:4.6.1637602169-1.el8
jenkins
Red Hat:openshift:4.7::el8
From an advisory covering 14 CVEs
 before 0:2.303.3.1637597018-1.el8
0:2.303.3.1637597018-1.el8
jenkins-2-plugins
Red Hat:openshift:4.7::el8
From an advisory covering 14 CVEs
 before 0:4.7.1637600997-1.el8
0:4.7.1637600997-1.el8
jenkins
Red Hat:openshift:3.11::el7
From an advisory covering 14 CVEs
 before 0:2.303.3.1637698110-1.el7
0:2.303.3.1637698110-1.el7
Show 26 moreShow less
Affected packages
PackageAffectedFixed
jenkins-2-plugins
Red Hat:openshift:3.11::el7
From an advisory covering 14 CVEs
 before 0:3.11.1637699107-1.el7
0:3.11.1637699107-1.el7
coreos-installer
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:0.9.0-8.rhaos4.8.el8
0:0.9.0-8.rhaos4.8.el8
jenkins
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:2.303.3.1637596565-1.el8
0:2.303.3.1637596565-1.el8
jenkins-2-plugins
Red Hat:openshift:4.8::el8
From an advisory covering 15 CVEs
 before 0:4.8.1637599935-1.el8
0:4.8.1637599935-1.el8
jenkins
Red Hat:openshift:4.9::el8
From an advisory covering 14 CVEs
 before 0:2.303.3.1637595827-1.el8
0:2.303.3.1637595827-1.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
From an advisory covering 14 CVEs
 before 0:4.9.1637598812-1.el8
0:4.9.1637598812-1.el8
jenkins
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:2.319.2.1643288987-1.el8
0:2.319.2.1643288987-1.el8
coreos-installer
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-bootinfra
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-bootinfra-debuginfo
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-debuginfo
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-debugsource
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:4.10.1643404185-1.el8
0:4.10.1643404185-1.el8
cri-o
Red Hat:openshift:4.10::el7
From an advisory covering 24 CVEs
 before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
cri-o-debuginfo
Red Hat:openshift:4.10::el7
From an advisory covering 24 CVEs
 before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
cri-o
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
cri-o-debuginfo
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
cri-o-debugsource
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
openshift
Red Hat:openshift:4.10::el7
From an advisory covering 24 CVEs
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
openshift-clients
Red Hat:openshift:4.10::el7
From an advisory covering 24 CVEs
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
openshift-clients-redistributable
Red Hat:openshift:4.10::el7
From an advisory covering 24 CVEs
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
openshift-hyperkube
Red Hat:openshift:4.10::el7
From an advisory covering 24 CVEs
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
openshift
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
openshift-clients
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
openshift-clients-redistributable
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.10::el8
From an advisory covering 24 CVEs
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21697 is a critical vulnerability (CVSS 9.1) in Jenkins, published November 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.319.

References

Show 131 moreShow less
This page doesn't list everything

Left out here: 658 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open