---
title: "Jenkins CLI Arbitrary File Read (CVE-2024-23897)"
url: https://erroneo.us/security/briefs/jenkins-cli-args4j-arbitrary-file-read/
description: "Jenkins 2.441 / LTS 2.426.2 and earlier let unauthenticated users read controller files via CLI '@file' expansion. Fixed in 2.442, LTS 2.426.3. In KEV. Act now."
type: security-brief
section: "Security Digest"
date_published: 2024-01-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2024-23897", "CVE-2024-23898"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Jenkins CLI Arbitrary File Read (CVE-2024-23897)

**Verdict: Act now.** An unpatched Jenkins controller reachable by untrusted users leaks files and secrets that can lead to full takeover; upgrade now or disable the CLI.

- **Who must act:** Operators of Jenkins weekly 2.441 or earlier or LTS 2.426.2 or earlier, especially controllers reachable from the internet or with anonymous read or open signup.
- **Who can relax:** Teams already on Jenkins 2.442+ or LTS 2.426.3+ (or any current release), and users of hosted CI systems that are not Jenkins.
- **Affected:** Jenkins weekly up to and including 2.441; Jenkins LTS up to and including 2.426.2
- **Fixed:** Jenkins 2.442; Jenkins LTS 2.426.3; Jenkins LTS 2.440.1
- **CVEs:** CVE-2024-23897, CVE-2024-23898
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version shown in the Jenkins web UI footer and upgrade to a current weekly or LTS release.
2. If you cannot upgrade today, apply the advisory's workaround to disable CLI access; it needs no restart.
3. Remove anonymous read access and disable self-signup unless you truly need them.
4. Do not expose the controller directly to the internet; put it behind VPN or SSO.
5. If an exposed controller was unpatched, rotate secrets stored in Jenkins (credentials, API tokens, SSH keys) and the controller's secret keys.

### How to check if you are affected

- Review web or reverse-proxy logs for CLI traffic from unexpected sources, especially before patching.
- Look for unexpected admin logins, new users, new API tokens or Script Console use.
- Check build logs and job configs for injected content and look for outbound connections from the controller you cannot explain.

## What happened

On January 24, 2024, the Jenkins project published a [security advisory](https://www.jenkins.io/security/advisory/2024-01-24/) for CVE-2024-23897. The Jenkins CLI parses commands with the args4j library, which has a feature called `expandAtFiles`: any argument written as `@` followed by a file path is replaced with that file's contents. The feature is on by default, and Jenkins did not turn it off, so a CLI user could make the controller read arbitrary files from its own filesystem and echo them back in error messages.

The bug was found by Yaniv Nizry of Sonar, who [reported it on November 13, 2023](https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/). The same advisory fixed CVE-2024-23898, a cross-site WebSocket hijacking issue in the CLI endpoint (CVSS 8.8).

## Who is affected

Jenkins weekly up to 2.441 and LTS up to 2.426.2. Fixes are in 2.442, LTS 2.426.3 and LTS 2.440.1. [NVD scores](https://nvd.nist.gov/vuln/detail/CVE-2024-23897) CVE-2024-23897 at 9.8.

How much an attacker can read depends on permissions:

- **With Overall/Read permission:** entire files.
- **Without it:** only the first few lines; researchers found ways to read the first three lines on recent releases without plugins.

Sonar notes that unauthenticated users effectively have read permission if legacy authorization mode is on, "Allow anonymous read access" is enabled, or self-signup is enabled. That is a common configuration on internal build servers.

## Do you really need to act?

If you are still on an affected version, yes. A file read on a CI controller is rarely "just" a file read. The advisory lists follow-on attacks that become possible once binary secrets can be extracted: remote code execution via Resource Root URLs, forged "Remember me" cookies (including for admins, opening the Script Console), stored XSS in build logs, CSRF protection bypass, decrypting stored secrets, deleting items and downloading heap dumps. Reading binary keys is harder on controllers using UTF-8 as the default encoding (over 90% of reporting instances), but much easier with Windows-1252.

Exploitation is not theoretical. CISA [added CVE-2024-23897 to KEV on August 19, 2024](https://www.cisa.gov/news-events/alerts/2024/08/19/cisa-adds-one-known-exploited-vulnerability-catalog), and as of October 21, 2026 the [KEV entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) marks it as known to be used in ransomware campaigns.

Lower risk: a controller that is reachable only from a trusted network, with no anonymous access or signup, limits who can try. But insiders and anyone already on that network still can, so plan the upgrade regardless.

## What to do now

1. Upgrade to a current Jenkins weekly or LTS release (at minimum 2.442 or LTS 2.426.3).
2. If you cannot upgrade immediately, use the advisory's workaround to disable CLI access. Jenkins says it should prevent exploitation completely and does not require a restart, but treat it as temporary.
3. Turn off anonymous read access and self-signup unless you need them.
4. Keep the controller off the open internet; front it with VPN or SSO.
5. If an exposed controller ran an affected version, rotate the credentials, API tokens and SSH keys stored in Jenkins, and review admin accounts.

## How to tell if you were hit

There is no single clean indicator. The file contents leak through ordinary CLI error responses, and Sonar's write-up shows the read working through the `connect-to-node` command, whose error message echoes the "node names" it was given. Review reverse-proxy and access logs for CLI traffic from unfamiliar sources during the vulnerable window. Then look for the consequences: new admin users or API tokens, Script Console use, unexpected job or build-log changes, and outbound connections from the controller.

## Timeline

- Nov 13, 2023 — Sonar reports the issues to the Jenkins security team.
- Jan 24, 2024 — Advisory and fixes released in 2.442 and LTS 2.426.3.
- Aug 19, 2024 — CISA adds CVE-2024-23897 to KEV.
- Oct 21, 2026 — Still in KEV with known ransomware use; brief updated.

## Sources

1. [Jenkins — Jenkins Security Advisory 2024-01-24](https://www.jenkins.io/security/advisory/2024-01-24/)
2. [NVD — CVE-2024-23897](https://nvd.nist.gov/vuln/detail/CVE-2024-23897)
3. [Sonar — Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins](https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/)
4. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Aug 19, 2024)](https://www.cisa.gov/news-events/alerts/2024/08/19/cisa-adds-one-known-exploited-vulnerability-catalog)
5. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---
Source page: https://erroneo.us/security/briefs/jenkins-cli-args4j-arbitrary-file-read/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt