Eggplant Runner
Monthly
Information disclosure in the Jenkins Eggplant Runner Plugin (0.0.1.301.v963cffe8ddb_8 and earlier) weakens a built-in Java runtime safeguard by clearing the `jdk.http.auth.tunneling.disabledSchemes` system property, which by default stops the JDK from answering a proxy 407 challenge with Basic credentials over an HTTP CONNECT tunnel. The practical exposure is narrow: it only matters when the Jenkins controller or agent makes outbound HTTPS connections through a proxy that uses Basic authentication, and a privileged attacker already positioned to intercept traffic between Jenkins and that proxy must be present to observe the re-enabled credential exchange - reflected in the High attack-complexity rating (CVSS 5.9, AC:H, PR:N, UI:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.32% (23rd percentile); this is a moderate-priority hardening issue rather than an urgent one.
Information disclosure in the Jenkins Eggplant Runner Plugin (0.0.1.301.v963cffe8ddb_8 and earlier) weakens a built-in Java runtime safeguard by clearing the `jdk.http.auth.tunneling.disabledSchemes` system property, which by default stops the JDK from answering a proxy 407 challenge with Basic credentials over an HTTP CONNECT tunnel. The practical exposure is narrow: it only matters when the Jenkins controller or agent makes outbound HTTPS connections through a proxy that uses Basic authentication, and a privileged attacker already positioned to intercept traffic between Jenkins and that proxy must be present to observe the re-enabled credential exchange - reflected in the High attack-complexity rating (CVSS 5.9, AC:H, PR:N, UI:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.32% (23rd percentile); this is a moderate-priority hardening issue rather than an urgent one.