CVE-2017-1000356: Jenkins

High severity, CVSS 8.8. EPSS: 7% chance of exploitation in the next 30 days.

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.

Affected products

• Jenkins Jenkins: up to and including 2.56; up to and including 2.46.1

Published 2018-01-29. Last modified 2026-06-17.