Wiz Analysis Finds Widespread Jenkins Vulnerabilities, Outdated Plugins, and Misconfigurations
Summary
Wiz data highlights widespread Jenkins exposure to critical vulnerabilities, outdated components, and risky configurations. Attackers can use exposed instances, pipelines, plugins, or agents to steal credentials and pivot into cloud environments.
Key points
- 59% of cloud environments using Jenkins have instances vulnerable to critical core vulnerabilities; 2% expose vulnerable instances directly to the internet.
- More than 87% of Jenkins-using environments contain end-of-life instances; 48% run Jenkins on compute with highly privileged service accounts.
- 37% of environments use plugins with limited maintainer activity, 31% use deprecated plugins, and 21% run plugins with critical or high-severity vulnerabilities that have no patch available.
- Common risks include weak access controls, internet exposure, plaintext or unrotated secrets, unsafe pipeline inputs, and overly privileged controllers or agents.
- Attackers can abuse script execution, build pipelines, plugins, or compromised agents to execute code, extract credentials, persist, and move laterally.
- Compromised Jenkins instances can provide cloud credentials that attackers use to access cloud control planes and expand their operations.
- The article recommends operational hygiene, including patching, plugin lifecycle management, and configuration hardening.
Article Details
- Publisher
- Wiz
- Scope
- Jenkins security risks and attack patterns in cloud environments
- Sample Size
- Not disclosed
- Key Statistics
- 59% of cloud environments using Jenkins have instances vulnerable to critical-severity core vulnerabilities, according to Wiz data.
- 2% of cloud environments using Jenkins expose vulnerable instances directly to the internet.
- Over 87% of environments using Jenkins contain end-of-life instances.
- 48% of environments using Jenkins run it on compute with highly privileged service accounts.
- 37% of cloud environments use Jenkins plugins that are up for adoption.
- Recommendations
- Prioritize patching Jenkins and replacing unsupported or end-of-life instances.
- Review plugin lifecycle and remove or replace deprecated, unmaintained, or vulnerable plugins.
- Harden configuration by restricting exposure and access, enforcing RBAC, and limiting service-account privileges.
- Protect pipeline secrets, avoid exposing them through environment variables, and rotate them regularly.
Threat Actors
Vendors
Fox-ITsurface where build execution can be influenced by external input. Security research by vendors like Fox-IT, corroborated by real-world incidents, demonstrates that attackers can abuse CI/CD workflows to executeNCC GroupPrior research by NCC Group highlights how vulnerabilities in plugin and core interactions can be leveraged to gain elevated access and maintain long-term control of Jenkins environments.PraetorianWizof all cloud environments, and that core vulnerabilities remain a meaningful risk factor. According to Wiz data, 59% of cloud environments using Jenkins have instances vulnerable to critical-severity core
Products
JenkinsJenkins is an open-source automation server widely used for CI/CD orchestration, pipeline automation, and infrastructure workflows. It integrates deeply with source control systems, container registries, artifactWiz DefendAdditionally, Wiz Defend and Wiz Sensor monitor Jenkins workloads and their associated service accounts for suspicious and malicious activity, alerting on anomalous Jenkins control plane activity that could indicateWiz SensorAdditionally, Wiz Defend and Wiz Sensor monitor Jenkins workloads and their associated service accounts for suspicious and malicious activity, alerting on anomalous Jenkins control plane activity that could indicate