Jenkins Pipeline Multibranch Plugin Vulnerability Exposes Credentials
CVE-2026-92130

3.1LOW

Key Information:

Vendor

Jenkins
Status
Jenkins Pipeline: Multibranch Plugin
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92130?

The Jenkins Pipeline: Multibranch Plugin prior to version 841.vec5b_9e1806ec fails to establish a secure context for credential lookup during the resolveScm Pipeline step. This oversight enables an attacker that has Item/Configure permissions to gain unauthorized access to sensitive credentials, potentially exposing them to malicious activities.

Affected Version(s)

Jenkins Pipeline: Multibranch Plugin 0 <= 841.vec5b_9e1806ec

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECU...
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.