GHSA-j852-mp82-wv2g
Improper permission checks in Jenkins Swarm Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:swarm | < 3.21 | 3.21 |
Details
As written in the advisory (Markdown source, shown as plain text).
Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent.
Swarm Plugin 3.21 requires Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
References
External links from the advisory. They lead to third-party sites.