Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-06-10
https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3744
Scores
CVSS v3
5.3
EPSS
0.0018
EPSS Percentile
7.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-311
Status
published
Products (4)
jenkins/jenkins
< 2.555.3
jenkins/jenkins
< 2.568
Jenkins Project/Jenkins
2.555.3 - 2.555.*
Jenkins Project/Jenkins
2.568
Published
Jun 10, 2026
Tracked Since
Jun 10, 2026