2026-08-05 SECURITY-3911 / SECURITY-3930 Workaround

Issue

This article contains steps to workaround SECURITY-3911 / SECURITY-3930 for CloudBees CI clients who are not yet upgraded to version 2.568.2.37664.

CloudBees CI 2.568.2.37664 contains additional fixes for security issues that this Java agent does not protect from. Those security issues have additional prerequisites that make exploitation more difficult. Update CloudBees CI to protect from all issues fixed in that release.

Environment

Compatibility

https://github.com/jenkinsci-cert/SECURITY-3911-3930/blob/main/README.md#compatibility

Workaround for CloudBees CI on traditional platforms

Download the workaround jar into the JENKINS_HOME for the operations center and all controllers

curl -L -o /var/jenkins_home/security3911-3930-workaround.jar https://github.com/jenkinsci-cert/SECURITY-3911-3930/releases/download/security3911-3930-workaround-1.0/security3911-3930-workaround-1.0.jar▼

Update the operations center and all controllers to add the following Java argument, as per: How to add Java arguments to CloudBees CI?
```
-javaagent:/var/jenkins_home/security3911-3930-workaround.jar▼
```
Restart the operations center and all controllers to pick up the new Java argument

This workaround should be removed as soon as you upgrade to version 2.568.2.37664 or newer.

Workaround for CloudBees CI on modern cloud platforms

If you have any controllers that are offline, start all controllers.

To start all controllers using a cluster operation:

On the root level or within a folder of operations center, select New Item.
Specify a name for the cluster operation, for example "Start all controllers".
Select Cluster Operations as the item type.
Select Add Operation > managed controllers
Under Source, select From Operations Center Root.
Select Add Filter Is offline.
Select Add Step Start, and check Fail on error
Select Save.
Run the cluster operation
Confirm the cluster operation passed, and that all controllers are now online

Now that all controllers are online, apply the workaround:

Download the workaround jar into the operations center and all managed controller pods

NAMESPACE='ci'(1)
kubectl get pods -n "${NAMESPACE}" -l 'com.cloudbees.cje.type in (master,cjoc)' -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' > pods.txt(2)
while IFS= read -r pod; do
  kubectl exec "$pod" -n "${NAMESPACE}" -- curl -L -o /var/jenkins_home/security3911-3930-workaround.jar https://github.com/jenkinsci-cert/SECURITY-3911-3930/releases/download/security3911-3930-workaround-1.0/security3911-3930-workaround-1.0.jar(3)
done < pods.txt▼

1	Update `ci` to be the namespace for your cluster. If you have multiple namespaces, run this for each namespace that contains controllers or operations centers.
2	Saves the operations center and all controller pod names in the namespace to pods.txt
3	Downloads the workaround jar into each pod

Update the helm values for CloudBees CI to add -javaagent:/var/jenkins_home/security3911-3930-workaround.jar to the operations center and all managed controllers:

OperationsCenter:
  JavaOpts: -javaagent:/var/jenkins_home/security3911-3930-workaround.jar
Master:
  JavaOpts: -javaagent:/var/jenkins_home/security3911-3930-workaround.jar▼

The operations center will be automatically restarted when you apply the helm values
Reprovision (or stop and start) all managed controllers to pick up the new JavaOpts
1. On the root level or within a folder of operations center, select New Item.
2. Specify a name for the cluster operation, for example "Reprovision all controllers".
3. Select Cluster Operations as the item type.
4. Select Add Operation > managed controllers
5. Under Source, select From Operations Center Root.
6. Select Add Step Reprovision and check Fail on error and Force
7. Select Save.
8. Run the cluster operation
9. Confirm the cluster operation passed, and all controllers have restarted
If you have Traditional controllers connected to your Modern operations center:
1. Follow the steps from Workaround for CloudBees CI on traditional platforms

This workaround should be removed as soon as you upgrade to version 2.568.2.37664 or newer.

Verification the workaround is active

For the operations center:
1. Go to Manage Jenkins Script Console
2. Run the scripts from this page to verify SECURITY-3911-3930 verification
3. The output from both scripts should contain PROTECTED if the workaround is active
For the controllers:
1. Validating on an individual controller
  1. Navigate to Manage Jenkins Script Console (if using High Availability (HA), go to Manage Jenkins CloudBees CI High Availability (HA) Script Console)
  2. Run the scripts from this page to verify SECURITY-3911-3930 verification
  3. The output from both scripts should contain PROTECTED if the workaround is active
2. Validating on multiple controllers via cluster operation:
  1. On the root level or within a folder of operations center, select New Item.
  2. Specify a name for the cluster operation, for example "Validate SECURITY-3911 SECURITY-3930 Workaround on all controllers".
  3. Select Cluster Operations as the item type.
  4. Select Add Operation > Controllers
  5. Under Source, select From Operations Center Root.
  6. Select Add Step Execute Groovy Script on Controller and add the the script from SECURITY-3911 verification
  7. Select Add Step Execute Groovy Script on Controller and add the the script from SECURITY-3930 verification
  8. Select Save.
  9. Run the cluster operation job
  10. Review the logs from each controller in the cluster operation job log, the output from both scripts should contain PROTECTED if the workaround is active

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.