CVE-2025-59474
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
Versions it affects
Software versions checked with the free lookup that CVE-2025-59474 applies to, and the release that fixes it where the sources name one.
Is this running somewhere in your estate?
The Vulnerability Reporter inventories every machine and tells you when an advisory like this one applies to you.