EUVD-2026-26221
GHSA-p2rf-wpxj-mx2g
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Reached over the network but gated by a low-privileged account and a non-default delegated-credential/built-in-node config (PR:L, AC:H); controller RCE yields total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
AnalysisAI
Arbitrary file write in the Jenkins Credentials Binding Plugin (version 719.v80e905ef14eb_ and earlier) allows an authenticated user who can supply file or zip file credentials to a job to escape the intended credentials directory via unsanitized file names (path traversal), planting files anywhere on the node filesystem. When Jenkins is configured to let a low-privileged user configure such credentials for a job running on the built-in node, this file write escalates to remote code execution. There is no public exploit identified at time of analysis, and EPSS is low (0.34%, 57th percentile), consistent with the high attack complexity and non-default preconditions.
Technical ContextAI
The affected component is the Jenkins Credentials Binding Plugin, which binds stored credentials (secret text, files, usernames/passwords, and zip archives) into a build's environment or workspace at run time. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the plugin uses the credential's supplied file name to write the credential material to disk without sanitizing or canonicalizing it, so sequences such as '../' or absolute paths let the written file land outside the expected temporary credentials directory. The CPE cpe:2.3:a:jenkins_project:jenkins_credentials_binding_plugin identifies the single affected artifact. Because the built-in Jenkins controller node executes builds in the same JVM/host context, an attacker-controlled write to a location such as an init script, cron path, or Groovy init hook directory can be interpreted and executed, turning a file-write primitive into code execution on the controller.
RemediationAI
Upgrade the Jenkins Credentials Binding Plugin to the fixed release published in the vendor advisory (Patch available per vendor advisory - SECURITY-3672, https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3672; the fixed version is the release succeeding 719.v80e905ef14eb_, which should be confirmed directly against the advisory before deployment). Until patched, apply compensating controls: stop running builds on the built-in node by setting the controller's executor count to 0 and using dedicated agents, which removes the RCE-on-controller path (trade-off: requires available agents and may change where jobs run); restrict who can create or configure file/zip credentials by tightening authorization so only trusted administrators hold Credentials/Create and job Configure permissions (trade-off: reduces self-service for delegated teams); and review project-based/matrix authorization to ensure low-privileged users cannot configure credentials for controller-run jobs. Do not rely on network controls alone, as the primitive is triggered through legitimate authenticated Jenkins usage.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today