Jenkins project Vulnerabilities and Affected Products
Vulnerabilities associated with Jenkins Credentials Binding Plugin.
Products
Clear product- Jenkins124 vulnerabilities
- Jenkins Script Security Plugin29 vulnerabilities
- Jenkins Active Directory Plugin11 vulnerabilities
- Jenkins Pipeline: Groovy Plugin11 vulnerabilities
- Jenkins Email Extension Plugin9 vulnerabilities
- Jenkins Build Failure Analyzer Plugin8 vulnerabilities
- Jenkins NS-ND Integration Performance Publisher Plugin8 vulnerabilities
- Jenkins OpenId Connect Authentication Plugin8 vulnerabilities
- Jenkins Pipeline: Shared Groovy Libraries Plugin8 vulnerabilities
- Jenkins Amazon EC2 Plugin7 vulnerabilities
- Jenkins Configuration as Code Plugin7 vulnerabilities
- Jenkins Git Plugin7 vulnerabilities
- Jenkins Job Configuration History Plugin7 vulnerabilities
- Jenkins OpenShift Deployer Plugin7 vulnerabilities
- Jenkins Rundeck Plugin7 vulnerabilities
- Jenkins SAML Single Sign On(SSO) Plugin7 vulnerabilities
- Jenkins Artifactory Plugin6 vulnerabilities
- Jenkins Azure VM Agents Plugin6 vulnerabilities
- Jenkins Config File Provider Plugin6 vulnerabilities
- Jenkins Credentials Binding Plugin6 vulnerabilities
- Jenkins Deployment Dashboard Plugin6 vulnerabilities
- Jenkins ElectricFlow Plugin6 vulnerabilities
- Jenkins Git Parameter Plugin6 vulnerabilities
- Jenkins GitLab Authentication Plugin6 vulnerabilities
- Jenkins GitLab Plugin6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-48922HIGH | Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentialsJenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node. | CVSS7.5v3.1 | EPSS0.35% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42520HIGH | Jenkins Credentials Binding Plugin has a path traversal vulnerabilityJenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node. CWE-22Apr 29, 2026 | CVSS7.5v3.1 | EPSS0.411% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messagesJenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log. | CVSS-v4.0 | EPSS0.321% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-20616MEDIUM | Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding PluginJenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. | CVSS4.3v3.1 | EPSS0.852% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2182MEDIUM | Improper masking of some secrets in Jenkins Credentials Binding PluginJenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. CWE-522May 6, 2020 | CVSS4.3v3.1 | EPSS0.881% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2181MEDIUM | Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build stepsJenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps. CWE-522May 6, 2020 | CVSS6.5v3.1 | EPSS1.09% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |