CVE-2015-5320: Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave con...

Security readout for executives and security teams

Older Jenkins versions could let a remote attacker connect as a build slave if they knew a slave name. That connection could expose sensitive information and may allow administrative access. The issue is fixed in Jenkins 1.638 and LTS 1.625.2 or later. Exposure is most relevant to Jenkins controllers running versions before 1.638 or LTS before 1.625.2 with JNLP slave connections in use. The provided CVE data does not identify other affected products or package-specific version ranges beyond referenced Red Hat advisories. Prioritize remediation for internet-reachable or shared Jenkins environments because compromise could expose sensitive CI data and may lead to administrative access. Treat legacy Jenkins servers as urgent upgrade candidates, especially where agent connections are still used. Mitigation focus: Upgrade Jenkins to 1.638, LTS 1.625.2, or a later supported release.; Review the Jenkins security advisory for vendor-confirmed remediation guidance.; Apply relevant Red Hat security updates if using Red Hat-packaged Jenkins components..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.