CVE-2019-1010241

The CVE-2019-1010241 entry affects Jenkins Credentials Binding Plugin (v1.17) where the vulnerability exists in config-variables.jelly at line 30 (passwordVariable). The underlying issue is storing passwords in a recoverable format (CWE-257). As described, authenticated users can recover credenti...

CVE-2020-2181

CVE-2020-2181 affects Jenkins Credentials Binding Plugin (versions 1.22 and earlier) where secrets are not masked in build logs when a build contains no build steps. This is documented in a GHSA advisory for Jenkins Credentials Binding Plugin and reflected in Red Hat advisories linking CVE-2020-2...

CVE-2020-2182

CVE-2020-2182 affects Jenkins Credentials Binding Plugin up to version 1.22. The root issue is improper masking of secrets containing a dollar sign: after escaping $ to $$ (to prevent premature expansion), the escaped form was not masked in some cases (e.g., certain build steps). The advisory ind...

CVE-2022-20616

CVE-2022-20616 refers to the Jenkins Credentials Binding Plugin (version ≤ 1.27) where a missing permission check in the form-validation method allows users with Overall/Read access to determine whether a given credential ID points to a secret file credential and whether it is a ZIP file. The des...

CVE-2018-1000057

CVE-2018-1000057 affects Jenkins Credentials Binding Plugin (version 1.14 and earlier). The issue is that Jenkins masks passwords in logs but can transform values (e.g., resolving environment variable references), causing password-like values to be exposed or recoverable. This is due to substitut...

CVE-2026-42520

The Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb_ and earlier are vulnerable to a path traversal vulnerability due to a lack of sanitization for file names in file and zip file credentials. This allows an attacker to provide credentials to a job that write files to arbitrary loca...

CVE-2025-53650

The Jenkins Credentials Binding Plugin (version 687.v619cb_15e923f and earlier) contains a vulnerability where it fails to properly mask credentials (replacing them with asterisks) when they appear in exception error messages written to the build log . An attacker could potentially obtain sensiti...

CVE-2026-48922

The Jenkins Credentials Binding Plugin versions 720.v3f6decef43ea_ and earlier are vulnerable to a path traversal issue due to insufficient sanitization of file names for file and zip file credentials. This allows an attacker who can provide credentials to a job to write files to arbitrary locati...