When a user without Overall/Read permission try to use Jenkins CLI, the message "You must authenticate to access this Jenkins" appears which is misleading. A message saying that the access is denied would be more appropriate.

Example:

• Generate SSH key
• Attach the public key to a user in Jenkins
• Remove permission so that this user does not have the Overall/Read permission
• Run the following command:

java -jar jenkins-cli.jar -s http://jenkins.server:8080/ -i ~/.ssh/id_rsa help

• Following message appears:

You must authenticate to access this Jenkins
Use --username/--password/--password-file parameters or login command.

Source code here: https://github.com/jenkinsci/jenkins/blob/jenkins-1.644/core/src/main/java/hudson/cli/HelpCommand.java#L52-L56