# Jenkins Unauthenticated Access Detection

> Detect exposed Jenkins instances allowing unauthenticated access, identifying misconfigured dashboards, script consoles, and API endpoints that enable RCE or data exfiltration.

- **URL:** https://hackindex.io/services/jenkins/vulnerability-discovery/jenkins-unauthenticated-access
- **Path:** Jenkins > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/jenkins/vulnerability-discovery.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Jenkins instances frequently expose sensitive endpoints without authentication. Default installations before version 2.0 had no security enabled at all. Even on newer versions, administrators often misconfigure authorization to allow anonymous read access or leave the script console exposed. This page confirms which high-value endpoints are accessible without credentials. For version and API enumeration, see [Jenkins enumeration](https://hackindex.io/services/jenkins/enumeration/jenkins-enumeration).

## Script Console Access

The Groovy script console at `/script` executes arbitrary code on the Jenkins server. If it loads without a login redirect, the instance is vulnerable to immediate RCE.

```bash
curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/script
# 200
```

## Credential Store Exposure

The credentials page at `/credentials/` lists stored secrets. If accessible without auth, it reveals credential types and IDs. The actual secret values are masked in the UI but can be extracted through the script console or API if either is also accessible.

```bash
curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/credentials/
# 200
```

## Build and Workspace Access

Build logs and workspaces contain source code, environment variables, deployment scripts, and credentials leaked during execution. Check whether anonymous users can read them.

**Check build log access**

```bash
curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/job/deploy-production/lastBuild/consoleText
# 200
```

**Check workspace access**

```bash
curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/job/deploy-production/ws/
# 200
```

## System Information Disclosure

The `/systemInfo` page shows JVM version, OS details, and all Java system properties. Environment variables may contain AWS keys, database passwords, or API tokens.

```bash
curl -s http://$TARGET_IP:$PORT/systemInfo -o /dev/null -w '%{http_code}'
# 200
```

## CLI Endpoint Check

The Jenkins CLI JAR is downloadable at `/jnlpJars/jenkins-cli.jar`. If the CLI is enabled, it can be used for [CVE-2024-23897 arbitrary file read](https://hackindex.io/services/jenkins/exploitation/jenkins-arbitrary-file-read-cve-2024-23897) even without authentication.

```bash
curl -s -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/jnlpJars/jenkins-cli.jar
# 200
```

## Default Credentials

Jenkins installations using the setup wizard generate a random initial admin password stored at `/var/lib/jenkins/secrets/initialAdminPassword`. Installations that skip the wizard or use configuration management may have default or weak credentials.

```bash
curl -s -o /dev/null -w '%{http_code}' -u admin:admin http://$TARGET_IP:$PORT/api/json
# 200
```

## References

- [Jenkins: Security Best Practices](https://www.jenkins.io/doc/book/security/) - Authorization matrix, CSRF protection, and access control configuration.
- [Hacking Articles: Jenkins Penetration Testing](https://www.hackingarticles.in/jenkins-penetration-testing/) - Enumeration and exploitation walkthrough.