EUVD-2026-53527
GHSA-rgw8-wchj-9xjv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoints require PR:L (Overall/Read); only credential IDs disclosed, not secrets, so C:L; no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Missing permission checks in HCL AppScan Plugin 1.8.3 and earlier expose multiple Jenkins HTTP endpoints to any authenticated user holding Overall/Read permission, enabling enumeration of credentials IDs stored in Jenkins. Credential ID disclosure is a stepping-stone attack: while the raw secrets are not returned, knowledge of credential IDs can be combined with a separate vulnerability to capture those credentials. No public exploit or active exploitation has been confirmed. A patched release (1.8.4) is available.
Technical ContextAI
The HCL AppScan Plugin integrates Jenkins CI/CD pipelines with HCL's AppScan application security scanning platform. Jenkins plugins commonly expose HTTP endpoints (Stapler-routed actions or form validation URLs) that interact with Jenkins' credential store. The root cause is missing authorization checks (consistent with CWE-862: Missing Authorization) on those endpoints - they return credential IDs from the Jenkins Credentials Plugin store without verifying that the caller holds a sufficient permission (e.g., Credentials/View). Overall/Read is the baseline permission granted to virtually every authenticated Jenkins user, meaning this is effectively a low-privilege information disclosure against the credential namespace.
RemediationAI
Upgrade HCL AppScan Plugin to version 1.8.4 or later via the Jenkins Plugin Manager (Manage Jenkins → Plugins → Updates tab). The patched version adds proper permission checks to the affected HTTP endpoints. If immediate upgrade is not possible, restrict Overall/Read access to trusted users only as a compensating control - this reduces the pool of potential enumerators but does not eliminate the flaw for any authenticated user. Additionally, audit Jenkins Credentials store access logs for unusual enumeration patterns targeting the AppScan plugin endpoints. Full advisory and update instructions are available at https://www.jenkins.io/security/advisory/2026-08-05/.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in. Rated high severity (CVSS 8.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today