CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-92130

The Jenkins Pipeline: Multibranch Plugin (workflow-multibranch) versions 841.vec5b_9e1806ec and earlier contains a vulnerability where it fails to set the appropriate context for credentials lookup during the resolveScm Pipeline step. This flaw allows attackers with Item/Configure permissions to ...

EUVD-2026-80754

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

CVE-2026-92130

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

PT-2026-93773

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Multibranch Plugin versions prior to 841.vec5b 9e1806ec Description An issue exists in the resolveScm Pipeline step where the appropriate context for credentials lookup is not set. This allows users with Item/Configure...

CVE-2026-92130: Incorrect Authorization

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

workflow-multibranch: OS command execution through crafted SCM contents

A flaw was found in Jenkins. The Pipeline: Multibranch uses the same checkout directories for distinct SCMs for the readTrusted step. This flaw allows attackers with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.This allows attackers to...

workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Multibranch follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step. This flaw allows attackers that can configure Pipelines, to read arbitrary files on the Jenkins...

PT-2022-17118 · Jenkins · Jenkins Pipeline: Multibranch Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Multibranch Plugin versions 706.vd43c65dec013 and earlier Jenkins Pipeline: Multibranch Plugin prior to 2.23.1, 2.26.1, 696.698.v9b4218eea50f, and 707.v71c3f0a 6ccdb Description: The issue allows attackers with permission to...

CVE-2022-25175

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents...

CVE-2022-25179

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the...

CVE-2022-25175: Improper Neutralization of Special Elements used in an OS Command

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents...