CVE-2026-42520 json
Jenkins Credentials Binding Plugin has a path traversal vulnerability
published 2026-04-29 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-26221 , GHSA-p2rf-wpxj-mx2g
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
Patch / fix
- maven org.jenkins-ci.plugins:credentials-binding 720.v3f6decef43ea
- jenkins credentials_binding 720.v3f6decef43ea_
- org.jenkins-ci.plugins credentials-binding 720.v3f6decef43ea_
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:credentials-binding | <720.v3f6decef43ea |
720.v3f6decef43ea |
Affected products
- Jenkins Project Jenkins Credentials Binding Plugin
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
jenkins.io
/security/advisory/2026-04-29/#SECURITY-3672
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-42520
advisory
-
github.com
/jenkinsci/credentials-binding-plugin
package
Sources
- CVE List CVE-2026-42520
- GitHub Advisory GHSA-p2rf-wpxj-mx2g
- NVD CVE-2026-42520
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.