What is the CVSS score of CVE-2026-48926?

CVE-2026-48926 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48926?

Yes, a patch is available for CVE-2026-48926. Update the affected software to the latest version immediately.

Jenkins Job Import Plugin CVE-2026-48926

EUVD-2026-32517 MEDIUM

Improper Privilege Management (CWE-269)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-p8jh-4p5p-2rfp

Privilege Escalation Jenkins

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:12 vuln.today

DescriptionCVE.org

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

AnalysisAI

Jenkins Job Import Plugin version 143.v044a_2e819b_27 and earlier exposes credentials ID enumeration to any authenticated user holding the minimal Overall/Read permission due to a missing permission check on an HTTP endpoint. Any low-privileged Jenkins user can query this endpoint and retrieve the IDs of all credentials stored in the Jenkins credentials store, enabling reconnaissance for follow-on credential-targeting attacks. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and SSVC rates exploitation status as none with partial technical impact.

Technical ContextAI

The Jenkins Job Import Plugin facilitates importing job configurations from remote Jenkins instances and, as part of its functionality, exposes HTTP API endpoints that interact with Jenkins' internal credentials store. The root cause is CWE-269 (Improper Privilege Management): the plugin's HTTP endpoint responsible for listing credentials does not enforce a privilege gate - such as the Credentials/View or Job/Configure permission - before returning data. Jenkins employs a granular role-based authorization model; Overall/Read is the lowest authenticated permission level, typically assigned by default to all logged-in users. By failing to require a higher permission tier, the endpoint leaks credentials IDs (not credential values) to effectively any authenticated user. The affected scope spans all releases of the plugin from version 0 through 143.v044a_2e819b_27, as confirmed by ENISA EUVD-2026-32517.

RemediationAI

Upgrade the Jenkins Job Import Plugin to a version newer than 143.v044a_2e819b_27 per the Jenkins Security Advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3783 - the exact patched release version was not confirmed in available input data and should be verified directly against that advisory before deployment. If immediate patching is not feasible, a compensating control is to restrict Overall/Read access in Jenkins global security configuration to only explicitly trusted personnel, reducing the pool of users who can reach the vulnerable endpoint; however, this trades off against normal developer self-service access and may require workflow adjustments. An additional compensating measure is to audit stored credentials and ensure IDs do not reveal sensitive metadata (e.g., environment names, account types), reducing the reconnaissance value of enumeration without eliminating the underlying vulnerability.