Skip to content
HackIndex.io

Jenkins Unauthenticated Access Detection

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Jenkins instances frequently expose sensitive endpoints without authentication. Default installations before version 2.0 had no security enabled at all. Even on newer versions, administrators often misconfigure authorization to allow anonymous read access or leave the script console exposed. This page confirms which high-value endpoints are accessible without credentials. For version and API enumeration, see Jenkins enumeration.

Script Console Access

The Groovy script console at /script executes arbitrary code on the Jenkins server. If it loads without a login redirect, the instance is vulnerable to immediate RCE.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/script 
200

200 means the script console is accessible. Proceed to Groovy console RCE. 403 or 302 to /login means authentication is required for this endpoint.

Credential Store Exposure

The credentials page at /credentials/ lists stored secrets. If accessible without auth, it reveals credential types and IDs. The actual secret values are masked in the UI but can be extracted through the script console or API if either is also accessible.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/credentials/ 
200

Build and Workspace Access

Build logs and workspaces contain source code, environment variables, deployment scripts, and credentials leaked during execution. Check whether anonymous users can read them.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/job/deploy-production/lastBuild/consoleText 
200
┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/job/deploy-production/ws/ 
200

Workspaces expose the job's working directory: source code, build artifacts, config files, and .env files.

System Information Disclosure

The /systemInfo page shows JVM version, OS details, and all Java system properties. Environment variables may contain AWS keys, database passwords, or API tokens.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:$PORT/systemInfo -o /dev/null -w '%{http_code}' 
200

CLI Endpoint Check

The Jenkins CLI JAR is downloadable at /jnlpJars/jenkins-cli.jar. If the CLI is enabled, it can be used for CVE-2024-23897 arbitrary file read even without authentication.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/jnlpJars/jenkins-cli.jar 
200

200 means the CLI JAR is available for download. This does not confirm CVE-2024-23897, but confirms the CLI attack surface exists.

Default Credentials

Jenkins installations using the setup wizard generate a random initial admin password stored at /var/lib/jenkins/secrets/initialAdminPassword. Installations that skip the wizard or use configuration management may have default or weak credentials.

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w '%{http_code}' -u admin:admin http://$TARGET_IP:$PORT/api/json 
200

Try admin:admin, admin:password, admin:jenkins. 200 with valid JSON means the credentials work.

References