{
  "id": 9026504,
  "title": "Internet-Exposed Jenkins Controllers: Measuring a Persistent Attack Surface",
  "url": "https://urgent.news/2026/09/21/internet-exposed-jenkins-controllers-measuring-a-persistent-attack",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-21T22:20:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/internet-exposed-jenkins-controllers-measuring-a-persistent-attack-surface-1po0"
  },
  "original_language": "en",
  "account": "Jenkins, a widely used automation server, has numerous internet-reachable controller instances, creating a persistent attack surface. A ZoomEye scan found 1,537 matching instances, indicating a significant exposure problem. Jenkins controllers are often deployed by non-security teams, leading to lack of visibility in vulnerability scanning. This makes it simple for external build agents or webhooks to access the controller, which is typically installed on a public-facing virtual machine. The plugin ecosystem further complicates matters, as each plugin has its own release cycle and advisories, making it challenging to keep the controller up-to-date.\n\nSeveral recent Jenkins security advisories highlight vulnerabilities specific to internet-reachable controllers, such as arbitrary file read through the CLI, path traversal, and stored cross-site scripting in plugins. A notable example is CVE-2024-23897, which allows an unauthenticated attacker to read files from the controller, potentially exposing sensitive information like credentials and configuration. This vulnerability gained attention due to the prevalence of internet-accessible controllers. To mitigate the risk, defenders should verify if Jenkins controllers are reachable from the internet and treat this as a finding regardless of authentication settings. Controllers should be moved behind a VPN or an identity-aware proxy, allowing only necessary endpoints for external agents. Staying updated with Jenkins core and plugin advisories, rotating stored credentials, and minimizing the scope of secrets accessible through a single controller are crucial steps. Additionally, retaining and forwarding build logs to a system the controller cannot modify is recommended. Despite Jenkins exposure not being a new issue, the scale of internet-reachable instances remains a significant concern, as these controllers hold valuable credentials and produce trusted artifacts that can impact the entire build system.",
  "summary": "Internet-Exposed Jenkins Controllers: Measuring a Persistent Attack Surface Jenkins is one of the most widely deployed automation servers in the world, and a meaningful share of those deployments are reachable from the public internet. That combination has produced a steady stream of serious vulnerabilities, including CVE-2024-23897, an arbitrary file read in the Jenkins CLI that could expose…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}