CVE-2014-9634: Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, wh...

Security readout for executives and security teams

This issue could let an attacker capture a Jenkins session cookie if Jenkins sent it over HTTP. A stolen session cookie can allow account impersonation. The cited scope is Jenkins before 1.586 running on Tomcat 7.0.41 or later. Exposure is limited to Jenkins deployments before 1.586 on Tomcat 7.0.41 or later, where session cookies can be transmitted within HTTP sessions. The source bundle does not identify other affected products. Treat as a targeted remediation item for legacy Jenkins. Business urgency rises if Jenkins is internet-accessible, carries production secrets, or users can reach it over HTTP. Mitigation focus: Upgrade affected Jenkins installations to version 1.586 or later.; Check Jenkins vendor guidance and distribution advisories for packaged fixes.; Require HTTPS-only access to Jenkins where operationally possible..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.