Jenkins ThinBackup Plugin CVE-2026-84667

Exploitation requires an authenticated Jenkins user account - at minimum a user with the ability to submit HTTP POST requests to the Jenkins web UI (Overall/Read plus plugin endpoint access). The attacker must be able to reach the ThinBackup plugin's Stapler configuration endpoint. A second triggering step is required: either waiting for a scheduled backup or having sufficient permission to trigger one manually, meaning exploitation is not single-step. Files readable by the Jenkins controller OS process user are the scope of potential exfiltration; the attacker cannot control backup content beyond path inclusion. Anonymous or unauthenticated exploitation is not possible given PR:L. Non-default plugin installation is required (ThinBackup must be installed), which limits exposure to Jenkins instances where this plugin is deployed.

The CVSS 7.1 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N is well-calibrated: PR:L correctly reflects the requirement for an active authenticated Jenkins session, meaningfully narrowing the attack surface compared to unauthenticated issues. The C:H rating is the dominant risk driver - Jenkins controllers routinely store credentials, private keys, and secrets that represent the highest-value assets in a CI/CD pipeline. The I:L component reflects the attacker's ability to redirect backup write destination but not to control the content written, making this a read-heavy risk profile. SSVC assessment (exploitation: none, automatable: no, technical impact: partial) aligns with the authenticated requirement and the two-step nature of exploitation (config overwrite followed by backup trigger). No EPSS data was provided and no KEV or POC indicators appear in the input. The real-world priority should be elevated on any Jenkins instance where low-trust users have web UI access, as the secrets exfiltration potential outweighs the moderate raw score.

An attacker with a low-privileged Jenkins account sends a crafted HTTP POST to the ThinBackup plugin Stapler configuration URL, overwriting the backup target directory to a web-accessible path or network share and adding /var/jenkins_home/credentials.xml and secrets/master.key to the inclusion list. On the next scheduled or manually triggered backup run, the plugin archives those files to the attacker-controlled location, from which the attacker retrieves them and decrypts stored Jenkins credentials. No public exploit code has been identified at time of analysis.