EUVD-2026-70147
GHSA-q7cv-8mcr-f55q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Read-only credential ID enumeration has no integrity impact, so I:N replaces the vendor's I:L; remaining metrics align with description.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
AnalysisAI
Missing authorization checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier permit any authenticated Jenkins user holding Overall/Read permission to enumerate the IDs of credentials stored in the Jenkins Credentials store. Although credential values (passwords, tokens, certificates) are not directly exposed, the disclosed identifiers constitute reconnaissance data that could guide follow-on attacks against CI/CD pipeline secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Jenkins account with at minimum Overall/Read permission - the lowest authenticated privilege level in Jenkins, typically granted to every logged-in user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 medium score reflects network accessibility (AV:N), low complexity (AC:L), and low required privileges (PR:L - Overall/Read), but bounded impact (C:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Jenkins XebiaLabs XL Deploy Plugin to a version beyond 26.1.0 per the Jenkins Security Advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3948; check the Jenkins Update Center for the latest available patched release, as the exact fixed version number was not stated in the available advisory data and could not be independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today