No authentication is configured

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_51
Category	IAM
Severity	HIGH

Impact

No authentication method is configured for the Jenkins instance. Anyone with network access to the instance has full control over it without being required to authenticate, allowing anonymous attackers to edit and execute jobs, modify settings, and administer the system.

Recommended Solution - Buildtime

Implement a secure authentication mechanism which provides security controls that meet industry best practices, such as integrating with the organization’s SSO solution. For more on authentication mechanisms refer to https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html.