CVE-2015-5325: Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restr...

Security readout for executives and security teams

This is an older Jenkins vulnerability where outdated controllers could fail to enforce intended restrictions between a JNLP slave and the master. In business terms, an affected Jenkins environment could let an attacker with access to a JNLP slave cross a boundary that was meant to protect the controller. Exposure is most likely in legacy Jenkins deployments older than 1.638, or LTS deployments older than 1.625.2, especially where JNLP slaves were enabled or trusted as part of build infrastructure. Treat this as a legacy CI/CD risk. If old Jenkins systems still exist, prioritize upgrade or retirement because CI servers often hold credentials, build artifacts, and deployment access. Mitigation focus: Upgrade Jenkins to 1.638 or later, or LTS 1.625.2 or later.; Apply relevant Red Hat security updates where Red Hat-packaged Jenkins is used.; Review the Jenkins 2015-11-11 advisory for vendor-specific guidance..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.