CVE-2024-23898: Jenkins CLI WebSocket endpoint cross-site hijacking allows command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though exploitation requires user interaction and no KEV listing exists.

What it is

Jenkins 2.217 through 2.441 and LTS 2.222.1 through 2.426.2 fail to validate the origin of requests to the CLI WebSocket endpoint, creating a cross-site WebSocket hijacking flaw. An attacker who lures a victim to a malicious page can ride the victim's authenticated session to run CLI commands on the Jenkins controller.

Impact

The attacker gains the ability to execute CLI commands on the Jenkins controller with the victim's privileges, which can lead to job manipulation, credential access and code execution on build infrastructure.

Attack surface

Reached over the network through the CLI WebSocket endpoint; no authentication is needed by the attacker, but a logged-in Jenkins user must be induced to visit an attacker-controlled page (UI:R).

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.67151 (99.3rd percentile), indicating a high likelihood of exploitation activity; references are vendor advisory and research blog only, with no public exploit tag.

What to do

• Upgrade Jenkins to a version after 2.441 or LTS after 2.426.2 as fixed in the vendor advisory SECURITY-3315.
• If immediate upgrade is not possible, disable or restrict the CLI WebSocket endpoint and limit network access to the Jenkins controller.
• Enforce strict Origin header validation or a reverse proxy that rejects cross-origin WebSocket upgrades.
• Reduce exposure by placing the Jenkins controller behind a VPN or allowlist rather than the public internet.
• Audit Jenkins accounts and API tokens for unexpected CLI activity after exposure.

Detection

• Monitor Jenkins logs for CLI WebSocket connections and CLI command invocations from unexpected source IPs or sessions.
• Alert on WebSocket upgrade requests to the CLI endpoint carrying foreign or missing Origin headers.
• Correlate Jenkins CLI activity with browser sessions of users who visited untrusted sites.
• Review controller audit logs for anomalous job creation, credential access or script execution following CLI use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.