CVE-2026-70437

The Jenkins Webhook Secret Credentials Provider Plugin version 16.v0cfa_f0215cf5 and earlier is vulnerable to a timing attack because it fails to use a constant-time comparison function when validating webhook bearer tokens. This flaw could allow an attacker to use statistical methods to derive a...

CVE-2026-70437: Observable Timing Discrepancy

Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...

Non-constant time webhook bearer token comparison in webhook-secret-credentials-provider

webhook-secret-credentials-provider 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer toke...

CVE-2023-24425

Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to...

Jenkins Plugin Kubernetes Credentials Provider 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin A security...

CVE-2023-24425

Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to...

Exposure of system-scoped Kubernetes credentials in kubernetes-credentials-provider

kubernetes-credentials-provider 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and...

CVE-2023-24425: Improper Access Control

Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to...

PT-2022-20407 · Jenkins · Blue Ocean Credentials Provider +2

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline SCM API for Blue Ocean Plugin versions 1.25.3 and earlier Description: The issue allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stor...

User-scoped credentials exposed to other users by blueocean-pipeline-scm-api

When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provid...