CVE-2026-84676
Received Received - Intake

Jenkins Parameterized Remote Trigger Plugin Credential Exposure

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Jenkins Project

Description
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84676
EUVD
EUVD-2026-70149

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jenkinsci parameterized_remote_trigger_plugin to 3.2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-311 The product does not encrypt sensitive or critical information before storage or transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Jenkins Parameterized Remote Trigger Plugin versions 3.2.2 and earlier. It involves the storage of tokens in an unencrypted format within job config.xml files on the Jenkins controller. These tokens can be accessed by users with Item/Extended Read permissions or those with access to the Jenkins controller file system.

Detection Guidance

Check Jenkins job config.xml files for unencrypted tokens. Use commands like 'grep -r "token" /var/lib/jenkins/jobs/' on the Jenkins controller file system. Users with Item/Extended Read permission can also inspect job configurations for stored tokens.

Impact Analysis

The vulnerability allows unauthorized users to view sensitive tokens stored in job configuration files. This could lead to unauthorized access to remote systems or services configured through the plugin, potentially resulting in data breaches or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations that require protection of sensitive data. Unauthorized access to tokens may result in data exposure, violating confidentiality requirements and potentially leading to legal or regulatory penalties.

Mitigation Strategies

Upgrade to a patched version of the Jenkins Parameterized Remote Trigger Plugin. Rotate any exposed tokens. Restrict Item/Extended Read permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart