IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-10 14:16

MODIFIED

2026-06-10 14:16

EPSS (Prob. Exploit)

0.18%

Top 92.2%

DATA SOURCES:

NVD 🔗 2026-06-10 RED HAT 🔗 2026-06-14 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-11-02

> DESCRIPTION

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY

Moderate

> GITHUB SECURITY ADVISORY

GHSA-m6wv-wh8g-64xc MODERATE

Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations

AFFECTED PACKAGES:

MAVEN / org.jenkins-ci.main:jenkins-core

>= 2.556, < 2.568

Fixed in: 2.568

MAVEN / org.jenkins-ci.main:jenkins-core

< 2.555.3

Fixed in: 2.555.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

1011 versions affected

ALIASES:

BIT-jenkins-2026-53442, GHSA-m6wv-wh8g-64xc

> HISTORIQUE DES MODIFICATIONS

Première apparition

10/06/2026 14:16

Source: NVD

📊 ENRICHISSEMENT 14/06/2026 05:00

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

N/A

Nouvelle valeur:

{ "threat_severity": "Moderate", "severity_scale": null }