Jenkins: inconsistent case handling in user and group names allows impersonation of other accounts

Impact

Jenkins treats case in user and group names inconsistently across its authentication and authorization paths. An attacker who can create a user or group whose name case-insensitively matches an existing one can, in some configurations, be treated as that principal and inherit its permissions. On a GPU fleet the Jenkins controller is usually the thing holding registry push credentials, cluster kubeconfigs, and firmware or driver rollout jobs, so inheriting an administrator's or release engineer's permissions means being able to change what image lands on the nodes. The record does not enumerate which security realms are affected, so the practical blast radius depends on your realm and whether name creation is open to the attacker.

Who can reach it

Anyone able to create a new user or group name in the configured security realm - open signup on the built-in database, or a directory or SSO source where the attacker influences account and group names. No prior Jenkins permissions on the target account are needed.

What to do

Upgrade past Jenkins 2.575 (weekly) or LTS 2.568.1; the advisory for 2026-08-05 SECURITY-3924 has the exact fixed releases - take them from there rather than assuming the next point release. In the meantime disable open signup and audit existing users and groups for names that differ only by case. Upgrading the controller is a Jenkins service restart with builds quiesced; agents and GPU nodes are untouched.

References

Related entries

• GlusterFS (glusterd, auth.allow): The auth.allow option does not actually restrict who may connect, so anyCVE-2018-1112 · GlusterFS (glusterd, auth.allow)High
• Altair PBS Professional / OpenPBS (pbs_mom): Pbs_mom, the daemon that executes jobs on every compute node, acceptsCVE-2019-15719 · Altair PBS Professional / OpenPBS (pbs_mom)High
• Ceph MON / MGR (ceph-mon, ceph-mgr): Ceph-mon and ceph-mgr fail to enforce the caps on an authenticated principal, so aCVE-2020-10736 · Ceph MON / MGR (ceph-mon, ceph-mgr)High
• Eaton Intelligent Power Manager (IPM) prior to 1.69 - meta_driver_srv.js: Unauthenticated arbitrary file deletionCVE-2021-23279 · Eaton Intelligent Power Manager (IPM) prior to 1.69 - meta_driver_srv.jsHigh
• Intel Data Center Manager: Improper neutralisation (injection) in Data Center Manager lets an authenticated userCVE-2022-21225 · Intel Data Center ManagerHigh
• Schneider Electric Data Center Expert (versions prior to v7.9.0) - credential storage: DCE stores device passwordsCVE-2022-32519 · Schneider Electric Data Center Expert (versions prior to v7.9.0) - credential storageHigh