Insecure Token Storage in Jenkins Parameterized Remote Trigger Plugin
CVE-2026-84676

4.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Parameterized Remote Trigger Plugin
Vendor
CVE Published:
2 September 2026

What is CVE-2026-84676?

The Jenkins Parameterized Remote Trigger Plugin stores sensitive tokens in plaintext within the job config.xml files on the Jenkins controller. This practice exposes the tokens to any user possessing Item/Extended Read permissions or who can access the file system of the Jenkins controller, potentially leading to unauthorized actions and significant security risks. It is crucial for users and administrators to review permissions and implement measures to secure sensitive configuration files.

Affected Version(s)

Jenkins Parameterized Remote Trigger Plugin 0 <= 3.2.2

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECU...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.