Arbitrary File Write Vulnerability in Jenkins Credentials Binding Plugin
CVE-2026-42520

7.5HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins Credentials Binding Plugin
Vendor
CVE Published:
29 April 2026

What is CVE-2026-42520?

A security vulnerability exists in the Jenkins Credentials Binding Plugin, where file names for file and zip file credentials are not properly sanitized. This flaw allows attackers with access to provide credentials to a job to write files to arbitrary locations within the node filesystem. If a Jenkins instance is configured to permit a low-privileged user to set up such file or zip file credentials, this could enable remote code execution, posing significant risks to the integrity of the system.

Affected Version(s)

Jenkins Credentials Binding Plugin 0 <= 719.v80e905ef14eb_

References

https://www.jenkins.io/security/advisory/2026-04-29/#SECU...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.