RHCOS 4 : OpenShift Container Platform 4.5.6 (RHSA-2020:3453)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3453 advisory. - jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps CVE-2020-2181 -...

Relative Path Traversal

Overview org.jenkins-ci.plugins:credentials-binding is a plugin that allows credentials to be bound to environment variables for use from miscellaneous build steps. Affected versions of this package are vulnerable to Relative Path Traversal due to not sanitizing file names for file and zip file...

com.amazon.jenkins.fleet:ec2-fleet (>=4.2.2.527.v38a_8758950a_0, <=4.2.3.540.va_6eedb_7b_c112), com.cloudbees.jenkins.plugins:amazon-ecs (1.50) +17 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (696.v256688029804)

org.jenkins-ci.plugins:credentials-binding MAVEN version 696.v256688029804 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.amazon.jenkins.fleet:ec2-fleet =4.2.2.527.v38a8758950a0,...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=37.v0d3157c4a_ef8, <=63.v7e87d06b_a_30c), com.amazon.jenkins.fleet:ec2-fleet (>=4.1.0.506.v619d63b_ec9d8, <=4.2.1.515.v100267825939) +71 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (687.v619cb_15e923f)

org.jenkins-ci.plugins:credentials-binding MAVEN version 687.v619cb15e923f is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

au.com.versent.jenkins.plugins:ignore-committer-strategy (29.v7c3891a_434c3), com.cloudbees.jenkins.plugins:amazon-ecr (1.151.vb_ca_71ddd0b_cf) +22 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (681.vf91669a_32e45)

org.jenkins-ci.plugins:credentials-binding MAVEN version 681.vf91669a32e45 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

com.mig82:folder-properties (57.vde5161ec7a_b_a), io.jenkins.blueocean:blueocean-pipeline-editor (>=1.27.17, <=1.27.18) +10 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (677.vdc9d38cb_254d)

org.jenkins-ci.plugins:credentials-binding MAVEN version 677.vdc9d38cb254d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.mig82:folder-properties 57.vde5161ec7aba -...

org.jenkins-ci.plugins:config-file-provider (>=973.vb_a_80ecb_9a_4d0, <=980.v88956a_a_5d6a_d), org.jenkins-ci.plugins:nodejs (>=1.6.2, <=1.6.4) +2 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (657.v2b_19db_7d6e6d)

org.jenkins-ci.plugins:credentials-binding MAVEN version 657.v2b19db7d6e6d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:config-file-provider =973.vba80ecb9a4d0,...

org.jenkins-ci.plugins:ec2 (>=1822.v87175d209b_b_5, <=1856.vf40220e7a_75f) potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (642.v737c34dea_6c2)

org.jenkins-ci.plugins:credentials-binding MAVEN version 642.v737c34dea6c2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:ec2 =1822.v87175d209bb5,...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.24)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves:...

org.jenkins-ci.plugins:docker-build-step (>=2.4, <=2.8) potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.18)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:docker-build-step =2.4, =2.8 Source cves:...

io.jenkins.plugins:aws-sam (>=1.2.7, <=1.2.13), org.jenkins-ci.plugins:azure-dev-spaces (>=3.0.0, <=3.0.3) +2 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.16)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:aws-sam =1.2.7, =3.0.0, =0.2.1, =2.0.13, =2.0.15 Source...

org.jenkinsci.plugins:pipeline-model-definition (>=1.2.6, <=1.2.7), org.waveywaves.jenkins.plugins:tekton-client (1.1.0) potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.13)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkinsci.plugins:pipeline-model-definition =1.2.6, =1.2.7 -...

com.nirima:docker-plugin (>=0.17, <=1.0.4), io.fabric8.jenkins.plugins:openshift-sync (>=1.0.43, <=1.0.45) +2 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.12)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.nirima:docker-plugin =0.17, =1.0.43, =1.7, =0.1.5, =0.2.0 Source cves:...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-1, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-1, <=1.2.0-beta-1) +16 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.11)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-1, =1.1.0-beta-1, =1.1.0-beta-1,...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.1) +17 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.10)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.testinium.jenkins:testinium 1.0 - io.jenkins.blueocean:blueocean...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +10 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.7)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.amazon.jenkins.fleet:ec2-fleet =1.0, =1.4, =0.3, =1.2.2, =1.13, =1.0.0,...

io.jenkins.plugins:artifactory-artifact-manager (>=318.v89d9642e6690, <=320.v6d1b_a_84b_16db), org.csanchez.jenkins.plugins:kubernetes (>=4467.vf26561292824, <=4560.vc25b_83890c34) +1 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (719.v80e905ef14eb)

org.jenkins-ci.plugins:credentials-binding MAVEN version 719.v80e905ef14eb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:artifactory-artifact-manager...

com.coravy.hudson.plugins.github:github (>=1.46.0, <=1.47.0), com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=61.v68b_d7264b_643, <=73.ve2b_957fc2921) +39 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (702.vfe613e537e88)

org.jenkins-ci.plugins:credentials-binding MAVEN version 702.vfe613e537e88 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.coravy.hudson.plugins.github:github =1.46.0,...

Jenkins Credentials Binding Plugin has a path traversal vulnerability

Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb and earlier do not sanitize file names for file and zip file credentials. This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a...

io.jenkins.blueocean:blueocean (>=1.0.0-b13, <=1.0.0-b21), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b15, <=1.0.0-b21) +7 more potentially affected by CVE-2026-42520 via org.jenkins-ci.plugins:credentials-binding (1.9)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b13, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15...