What is the CVSS score of CVE-2026-92130?

CVE-2026-92130 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.

Jenkins Pipeline: Multibranch Plugin CVE-2026-92130

EUVD-2026-80754 LOW

Incorrect Authorization (CWE-863)

2026-09-16 jenkins

GHSA-hmmg-x486-7jhf

Authentication Bypass Java Jenkins Jenkins Pipeline

3.1

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

PR:L for the required Item/Configure permission, AC:H because the attacker must craft resolveScm usage targeting specific mis-scoped credential IDs, C:L for limited credential disclosure with no integrity/availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 20:40 vuln.today

tag: Java added

Analysis Generated

Sep 16, 2026 - 20:25 vuln.today

CVSS changed

Sep 16, 2026 - 20:23 NVD

3.1 (LOW)

CVE Published

Sep 16, 2026 - 13:53 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.

AnalysisAI

Credential disclosure in Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier allows users who already hold Item/Configure permission to capture credentials they are not entitled to by authoring or modifying a Pipeline that invokes the resolveScm step, which fails to establish the correct context for credentials lookup. The issue is an access-control scoping flaw (CWE-863) rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting the authenticated Item/Configure prerequisite, the high complexity of targeting specific credential IDs, and impact limited to confidentiality with no integrity or availability effect. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the Pipeline: Multibranch Plugin at version 841.vec5b_9e1806ec or earlier, and an attacker who already holds Item/Configure permission on the Jenkins instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely low-severity, low-priority issue that the vendor CVSS of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately captures. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Jenkins Pipeline: Multibranch Plugin to a version later than 841.vec5b_9e1806ec as specified in the vendor advisory at https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3729; Jenkins plugin upgrades are performed through the Update Center or by installing the plugin HPI from the Jenkins releases site, followed by a Jenkins restart. … Detailed patch versions, workarounds, and compensating controls in full report.