CVE-2019-1003049: Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and new...

Security readout for executives and security teams

Jenkins instances could keep old CLI authentication caches valid after an upgrade that was supposed to close a prior CLI authentication issue. This matters when users had cached CLI authentication before the update, because they may remain authenticated unexpectedly on affected Jenkins versions. Exposure is most likely on Jenkins deployments running 2.171 or earlier, or LTS 2.164.1 or earlier, with users who previously cached CLI authentication before the relevant update. Prioritize remediation for internet-facing or shared Jenkins systems, especially where many users had CLI access. The business risk is unexpected continued authentication to CI/CD infrastructure, which can affect build integrity and deployment trust. Mitigation focus: Upgrade Jenkins according to the Jenkins SECURITY-1289 advisory.; Review vendor advisories from Jenkins, Red Hat, and Oracle for product-specific guidance.; Invalidate or remove stale remoting-based CLI authentication caches where applicable..

Prepared

Jun 6, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.