CVE-2015-5318: Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tok...

Security readout for executives and security teams

Older Jenkins versions generated CSRF protection tokens using a salt that could be publicly accessed. That weakened a protection meant to stop unwanted actions in a user’s browser, making bypass easier through brute force attempts. Exposure is likely limited to organizations still running Jenkins before 1.638 or LTS before 1.625.2, including vendor-packaged Jenkins versions covered by Red Hat advisories. Internet-accessible Jenkins increases business concern. Treat as a cleanup priority for legacy Jenkins. It is not supported by the supplied evidence as actively exploited, but outdated CI systems can affect software delivery and sensitive automation workflows. Mitigation focus: Upgrade Jenkins to 1.638 or later, or LTS 1.625.2 or later.; Apply relevant vendor security updates, including Red Hat packages where applicable.; Review Jenkins security advisory guidance for related 2015-11-11 fixes..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.