Race Condition in Jenkins

published 2018-01-24 8 y ago modified 2026-06-17 4 mo ago also GHSA-r5x3-2446-hrp7 , EUVD-2022-5103

cvss: 8.1; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default.

Patch / fix

fixed in 1 links 1

maven org.jenkins-ci.main:jenkins-core 2.89.2, 2.95

github.com/jenkinsci/jenkins@ccc374a commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-1000503 updated 2025-11-21 cvss 8.8

jenkins: Race condition during startup can result in default security settings not being applied

Red Hat OpenShift Enterprise 3 jenkins
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.15% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.main:jenkins-core	>=2.81, <2.89.2 >=2.90, <2.95	2.89.2 2.95

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

Technology feeds

Jenkins rss critical rss

References

github.com /jenkinsci/jenkins/commit/ccc374a7176d7704941fb494589790b7673efe2
web
jenkins.io /security/advisory/2017-12-14/
vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2017-1000503
advisory
github.com /jenkinsci/jenkins
package
jenkins.io /security/advisory/2017-12-14
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary