Jenkins Job Import Plugin EUVD-2026-32517

The attacker must hold a valid Jenkins account with at minimum the Overall/Read permission, which is the baseline authenticated permission and is assigned by default to all logged-in users in most Jenkins deployments. The Jenkins Job Import Plugin (version ≤ 143.v044a_2e819b_27) must be installed and active on the target instance. Exploitation is bounded by the authentication requirement (PR:L per CVSS vector) - unauthenticated external actors cannot trigger this without first acquiring any Jenkins account. The disclosure is limited to credentials IDs, not credential values or secrets, which constrains direct harm to reconnaissance and multi-stage attack enablement. No special non-default configuration is required beyond the plugin being present; the vulnerable endpoint is accessible in a default plugin installation.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates network-reachable, low-complexity exploitation by any authenticated user with no user interaction required, but the impact ceiling is confidentiality-partial with no integrity or availability consequences - only credentials IDs are exposed, not the secrets themselves. SSVC assessment rates exploitation as none and automatable as no, meaning this does not lend itself to opportunistic mass scanning and requires a deliberate, targeted action by a user who already holds a Jenkins account. No EPSS score was provided in the available input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing exists and no public exploit code has been identified. Real-world priority is moderate: in organizations with strict need-to-know credential naming practices or where Jenkins hosts high-value secrets, ID enumeration meaningfully aids reconnaissance; in environments where all Jenkins users are trusted, practical risk is low. No conflicting signals between CVSS and description - the network vector aligns with Jenkins being a web-accessible CI/CD platform.

An attacker who has obtained any valid Jenkins account - even a read-only contractor or developer account - sends a crafted HTTP GET request to the Job Import Plugin's credentials listing endpoint. Because the endpoint omits a permission check, the Jenkins server responds with the full list of credentials IDs stored in the instance, revealing names such as 'prod-aws-access-key' or 'deploy-ssh-key'. The attacker uses this enumerated list to plan targeted phishing, credential theft, or privilege escalation attempts against the identified secrets.