1,539 Jenkins Matches and 212 GitLab Matches: Measuring CI/CD Controllers as an Attack Surface

Two queries in the same measurement session returned app:"Jenkins" at 1,539 hosts and app:"GitLab" at 212 hosts. Both are CI/CD platforms, and both are the kind of system that holds credentials to everything it deploys to.

What the queries measure

Both are product fingerprint matches. ZoomEye identified endpoints responding consistently with Jenkins and GitLab respectively. Neither query indicates version, authentication configuration, or whether the instance is reachable by unauthenticated users beyond the fact that it was reachable by the scanner.

Why CI/CD controllers are a distinct category

A CI/CD controller is not a web application that happens to have a login page. It is a system whose function is to execute code, hold credentials, and deploy artefacts. That combination produces a distinct risk profile.

Jenkins, for example, executes build scripts defined in job configurations and in pipeline files. A user who can create or modify a job can generally execute code on the Jenkins controller or on its agents. The platform's extensibility through plugins expands this further: plugins can add credentials handling, cloud integrations, and build steps, and the plugin ecosystem has historically been a source of vulnerabilities.

GitLab's position is similar but broader. It holds source code, CI/CD variables, runner registration tokens, container registry credentials, and deploy keys. Its pipeline definitions execute on runners that frequently have access to production systems.

In both cases, the platform is a credential store and an execution engine. Exposure of the platform is therefore not comparable to exposure of a content management system.

Reading the two counts

The difference between 1,539 and 212 is not primarily about relative risk. Jenkins is commonly self-hosted and has a long history of internet-facing deployments. GitLab's self-managed footprint is smaller relative to its user base because many organisations use the hosted service, which does not appear in an external scan of this kind.

The counts are useful as an inventory check rather than as a comparison. For an organisation, the question is whether the number of CI/CD instances visible externally matches the number it believes it operates.

What the numbers do not say

The queries cannot distinguish between an instance that requires authentication and one that permits anonymous access. Jenkins historically shipped with a permissive default that allowed anonymous read access, and while the default has changed, instances configured years ago may retain the older behaviour. GitLab supports public projects and, in some configurations, public visibility of project metadata.

Neither query indicates whether the instance is patched. Both platforms have had critical vulnerabilities in the past year, including the GitLab path traversal issue that allowed unauthenticated arbitrary file reads, and version currency is the mechanism by which those are addressed.

Practical steps

Reconcile the counts against the internal inventory. A CI/CD instance visible externally but not tracked internally is the highest-priority finding, because it means the organisation does not know what it holds.

Confirm authentication requirements. Anonymous read access on a CI/CD platform can expose job configurations, environment variable names, and build logs, all of which may contain sensitive detail even without direct credential exposure.

Review the plugin and extension inventory. Both platforms' plugin ecosystems are part of the attack surface, and unmaintained plugins are a common source of vulnerabilities.

Check what credentials the platform holds. CI/CD controllers typically hold deployment credentials for production systems. If an instance was exposed, those credentials should be assessed for rotation.

References

• ZoomEye query app:"Jenkins", executed for this article. Result count and collection time are recorded in the source metadata.
• ZoomEye query app:"GitLab", executed in the same measurement session for comparison.
• Jenkins and GitLab security advisory channels.