What is the CVSS score of CVE-2026-48922?

CVE-2026-48922 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Jenkins Credentials Binding are affected by CVE-2026-48922?

Jenkins Credentials Binding Plugin (version 720.v3f6decef43ea_ and earlier) contains an arbitrary file-write vulnerability that could allow low-privileged user accounts with credential configuration…. A patch is available.

How to fix or mitigate CVE-2026-48922?

Within 24 hours: Inventory all Jenkins instances and document which are running Credentials Binding Plugin version 720.v3f6decef43ea_ or earlier. Within 7 days: Restrict credential configuration permissions to essential administrative staff; conduct audit of recent credential configurations. Within 30 days: Monitor official Jenkins security advisories for patch availability; plan immediate testing and deployment of patched version when released by Jenkins project.

Jenkins Credentials Binding CVE-2026-48922

EUVD-2026-32513 HIGH

Improper Input Validation (CWE-20)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-fxxf-w25w-mcx2

RCE Jenkins

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:13 vuln.today

CVSS changed

May 27, 2026 - 20:22 NVD

7.5 (None) 7.5 (HIGH)

DescriptionCVE.org

Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.

AnalysisAI

Arbitrary file write in the Jenkins Credentials Binding Plugin (version 720.v3f6decef43ea_ and earlier) lets users who can supply file or zip-file credentials to a job write files to attacker-chosen paths on the node filesystem, escalating to remote code execution when Jenkins is configured to let a low-privileged user configure such credentials for a job running on the built-in node. The flaw stems from missing file-name sanitization on the file and zip credential types. Rated CVSS 7.5 with high attack complexity (AC:H); no public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

The Credentials Binding Plugin makes Jenkins credentials available to builds by binding them to environment variables or materializing them as files on the workspace/node before a job runs. The 'secret file' and 'secret zip file' credential types are written to disk using a name derived from the credential, and per CWE-20 (Improper Input Validation) the plugin does not sanitize that file name, so directory-traversal sequences in the name let the written file land outside the intended directory anywhere the Jenkins process can write. The 'built-in node' referenced is the Jenkins controller itself; writing attacker-controlled file content to controller-level locations (for example init scripts, plugin or job configuration directories) is the bridge from file write to code execution. No CPE strings were provided in the source data to pin exact platform identifiers.

RemediationAI

Update the Credentials Binding Plugin to the fixed release identified in Jenkins advisory SECURITY-3790 (https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3790); the exact patched version number is not stated in the data provided here, so confirm it from that advisory before deploying. If immediate patching is not possible, reduce exposure by restricting which users can create or configure credentials - remove the ability for low-privileged users to configure file or zip-file credentials used by jobs (trade-off: those users lose self-service credential setup) - and by not running untrusted or user-configurable jobs on the built-in node, instead routing them to dedicated agents (trade-off: requires agent capacity and reconfiguration of job node assignments). Limiting Credentials/Configure permissions to trusted administrators removes the core precondition for this attack.