CVE-2020-2099: Jenkins

High severity, CVSS 8.6. EPSS: 1% chance of exploitation in the next 30 days.

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Affected products

• Jenkins Jenkins: up to and including 2.204.1; up to and including 2.218

Published 2020-01-29. Last modified 2026-06-17.