---
id: "CVE-2024-23897"
kind: "vulnerability"
aliases: ["CVE-2024-23897"]
title: "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Jenkins Jenkins Command Line Interface (CLI)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "jenkins", "fixed": ["2.426.3"], "affected": "< 2.426.3", "ecosystem": "vendor"}, {"name": "jenkins", "fixed": ["2.442"], "affected": "< 2.442", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "jenkins", "package", "ransomware", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2024-01-24T18:15:09+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23897", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that…

Jenkins CLI has a path traversal flaw that lets an attacker read certain files on the Jenkins server. Reading those files can lead to code execution, and CISA lists it as actively exploited with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Jenkins Jenkins Command Line Interface (CLI) affected ? fixed ?
- vendor:jenkins affected < 2.426.3 fixed 2.426.3
- vendor:jenkins affected < 2.442 fixed 2.442

## Fix

Apply the mitigations per the Jenkins vendor instructions, or discontinue use of the product if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23897
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-23897

## From the sources

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_