CVE-2020-2099

Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

8.6 HighFix available

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

1.01%Down 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 8.6

Record: CVE-2020-2099
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-330
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-2099
Updated: 2026-11-02

EUVDEUVD-2022-5008 No score

Record: EUVD-2022-5008
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qp4f-2w67-c8hw 8.6

Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While this protocol has been deprecated in 2018 and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.

This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.

Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE can be set to true to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.

Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.

Record: GHSA-qp4f-2w67-c8hw
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-323, CWE-330
Updated: 2026-11-02

OSV 8.6

Record: CVE-2020-2099
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

OSVGHSA-qp4f-2w67-c8hw 8.6

Inbound TCP Agent Protocol/3 authentication bypass in Jenkins

Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.

Record: GHSA-qp4f-2w67-c8hw
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-323, CWE-330
Updated: 2026-11-02

OSVRHBA-2020:0402 8.6

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update

Record: RHBA-2020:0402
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

OSVRHBA-2020:0675 8.6

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.5 packages update

Record: RHBA-2020:0675
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Updated: 2026-11-02

OSVBIT-jenkins-2020-2099 No score

Record: BIT-jenkins-2020-2099
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	before 2.204.2	2.204.2
`org.jenkins-ci.main:jenkins-core` Maven	2.205 up to 2.214	2.214
`jenkins` Bitnami	before 2.218.1	2.218.1
`org.jenkins-ci.main:jenkins-core` Maven	before 2.204.2, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	2.204.2
`org.jenkins-ci.main:jenkins-core` Maven	2.205 up to 2.214, plus listed versions 2.2062.2072.2082.2092.2102.2112.2122.213	2.214
`atomic-enterprise-service-catalog` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 1:3.11.170-1.git.1.91db82e.el7	1:3.11.170-1.git.1.91db82e.el7
`atomic-enterprise-service-catalog-svcat` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 1:3.11.170-1.git.1.91db82e.el7	1:3.11.170-1.git.1.91db82e.el7
`atomic-openshift` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-clients` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7

Show 41 moreShow less

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-2099 is a high vulnerability (CVSS 8.6) in Jenkins, published January 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.204.2.

References

Show 53 moreShow less

This page doesn't list everything

Left out here: 530 versions. The JSON record has them.

Package	Affected	Fixed
`atomic-openshift-cluster-autoscaler` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.0a0df6a.el7	0:3.11.170-1.git.1.0a0df6a.el7
`atomic-openshift-descheduler` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.9ad83f2.el7	0:3.11.170-1.git.1.9ad83f2.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-dockerregistry` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.55fab05.el7	0:3.11.170-1.git.1.55fab05.el7
`atomic-openshift-excluder` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-hyperkube` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-hypershift` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-master` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-metrics-server` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.357f177.el7	0:3.11.170-1.git.1.357f177.el7
`atomic-openshift-node` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-node-problem-detector` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.b1f90a6.el7	0:3.11.170-1.git.1.b1f90a6.el7
`atomic-openshift-pod` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-service-idler` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.8328979.el7	0:3.11.170-1.git.1.8328979.el7
`atomic-openshift-template-service-broker` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-tests` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.0.00cac56.el7	0:3.11.170-1.git.0.00cac56.el7
`atomic-openshift-web-console` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.3d64e8b.el7	0:3.11.170-1.git.1.3d64e8b.el7
`cri-o` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7	0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7
`cri-o-debuginfo` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7	0:1.11.16-0.5.dev.rhaos3.11.git3f89eba.el7
`golang-github-openshift-oauth-proxy` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.b49be83.el7	0:3.11.170-1.git.1.b49be83.el7
`golang-github-prometheus-alertmanager` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.61d7960.el7	0:3.11.170-1.git.1.61d7960.el7
`golang-github-prometheus-node_exporter` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.51473b7.el7	0:3.11.170-1.git.1.51473b7.el7
`golang-github-prometheus-prometheus` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.227bc98.el7	0:3.11.170-1.git.1.227bc98.el7
`jenkins` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:2.204.2.1580891656-1.el7	0:2.204.2.1580891656-1.el7
`jenkins-2-plugins` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.1579107288-1.el7	0:3.11.1579107288-1.el7
`openshift-ansible` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-docs` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-playbooks` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-roles` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-ansible-test` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-2.git.5.8802564.el7	0:3.11.170-2.git.5.8802564.el7
`openshift-enterprise-autoheal` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.dfe6c52.el7	0:3.11.170-1.git.1.dfe6c52.el7
`openshift-enterprise-cluster-capacity` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.661684b.el7	0:3.11.170-1.git.1.661684b.el7
`openshift-kuryr` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`openshift-kuryr-cni` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`openshift-kuryr-common` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`openshift-kuryr-controller` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`prometheus` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.227bc98.el7	0:3.11.170-1.git.1.227bc98.el7
`prometheus-alertmanager` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.61d7960.el7	0:3.11.170-1.git.1.61d7960.el7
`prometheus-node-exporter` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.51473b7.el7	0:3.11.170-1.git.1.51473b7.el7
`python2-kuryr-kubernetes` Red Hat:openshift:3.11::el7 From an advisory covering 8 CVEs	before 0:3.11.170-1.git.1.7265da1.el7	0:3.11.170-1.git.1.7265da1.el7
`jenkins` Red Hat:openshift:4.3::el7 From an advisory covering 7 CVEs	before 0:2.204.2.1583446818-1.el7	0:2.204.2.1583446818-1.el7