CVE-2016-0791: Jenkins

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

Affected products

• Jenkins Jenkins: up to and including 1.649; version 1.642.1 only
• Red Hat Openshift: version 3.1 only

Published 2016-04-07. Last modified 2026-06-17.