Jenkins Project Jenkins Credentials Binding Plugin vulnerabilities

6 vulnerabilities

Known vulnerabilities in Jenkins Project Jenkins Credentials Binding Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.3CVE-2025-53650jenkins projectjenkins credentials binding plugin+2
EPSS score
0.38%
Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.6.5CVE-2020-2181jenkins projectjenkins credentials binding plugin+2
EPSS score
1.11%
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.4.3CVE-2020-2182jenkins projectjenkins credentials binding plugin+2
EPSS score
0.90%
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.4.3CVE-2022-20616jenkins projectjenkins credentials binding plugin+2
EPSS score
0.85%
Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file.7.5CVE-2026-42520jenkins projectjenkins credentials binding plugin+2
EPSS score
0.60%
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.7.5CVE-2026-48922jenkins projectjenkins credentials binding plugin+2
EPSS score
0.58%
Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.