XL Deploy Plugin EUVD-2026-70147

Exploitation requires a valid Jenkins account with at minimum Overall/Read permission - the lowest authenticated privilege level in Jenkins, typically granted to every logged-in user. The Jenkins XebiaLabs XL Deploy Plugin version 26.1.0 or earlier must be installed and active on the target Jenkins controller. Unauthenticated or anonymous users cannot exploit this flaw; Jenkins instances that restrict anonymous access and limit Overall/Read to a small, fully trusted user base face effectively no incremental risk. The exposure is limited to credential IDs (names/identifiers) - credential values (passwords, tokens, private keys) are not returned. Organizations without low-trust or external accounts on their Jenkins instance should still patch but face lower urgency.

The CVSS 5.4 medium score reflects network accessibility (AV:N), low complexity (AC:L), and low required privileges (PR:L - Overall/Read), but bounded impact (C:L). The I:L component in the vendor-provided vector is unusual for a pure enumeration flaw that does not modify any data; it may reflect a broader conservative assessment and is worth verifying against the Jenkins advisory. SSVC rates exploitation as none and technical impact as partial, and marks the flaw as non-automatable, suggesting that bulk scanning for exploitable targets is unlikely. No EPSS data was provided, and the vulnerability is neither in CISA KEV nor accompanied by known POC code. Real-world risk is constrained to environments where untrusted or contractor accounts hold Overall/Read access - even a mid-sized municipal IT team in leszno running Jenkins for internal deployments would face minimal exposure if all users are vetted. The primary concern is metadata leakage enabling targeted credential-theft campaigns, not direct secret exfiltration.

An attacker with a basic Jenkins account (Overall/Read) - obtained through phishing, credential stuffing, or a contractor account - sends an HTTP request to the XL Deploy Plugin credential-enumeration endpoint on the Jenkins controller. The missing permission check causes the plugin to return a list of all stored credential IDs, revealing the names of API tokens, service account credentials, and deployment keys without exposing the values themselves. The attacker uses this inventory to craft targeted phishing lures or prioritize further attacks against the CI/CD pipeline. No public POC is identified, but the technique is straightforward for anyone with familiarity with Jenkins plugin API patterns.