A Jenkins host on the public internet served the script console to an anonymous caller. The authentication plugin was installed. The console was not behind it.
We sent one non-destructive script that printed the process user, the host name, and the Jenkins version. The response was the service account on that VM and a current 2.x version. Anonymous reads of the job list, the agent list, and the credentials root also answered.
We did not read credential values, change a job, drop a shell, or pivot.
What we proved
Remote code execution as the CI service account, shown by an identity print. The same console without the anonymous path is a login wall on a hardened Jenkins. Here the login wall was absent.
What this is not
Not "we own the domain." One identity print and a stop. The impact of an open script console is whatever that service account can reach. We did not map that further.
Why a scanner misses it
Version checks and default-password checks both pass if the anonymous user is simply allowed to compile Groovy. The proof is a print of user.name, not a CVE number.
Buyer takeaway: A CI script console on the internet is remote code execution. Authentication on the login form does not count if /script is anonymous.
