Is CVE-2026-48922 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48922 being exploited in the wild.

How severe is CVE-2026-48922?

High severity, with a CVSS score of 7.5, published 27 May 2026.

Which products and versions are affected?

Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_, 720.v3f6decef43ea_ and earlier; org.jenkins-ci.plugins:credentials-binding (Maven) <= 720.v3f6decef43ea, ECOSYSTEM:introduced=0,fixed=725.ve52b.

Is there a fix for CVE-2026-48922?

Yes. org.jenkins-ci.plugins:credentials-binding (Maven): upgrade to 725.ve52b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48922 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48922?

Check whether you run Jenkins Credentials Binding Plugin or org.jenkins-ci.plugins:credentials-binding (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48922: Jenkins Credentials Binding Plugin path traversal in file credentials

Q: Is there a fix for CVE-2026-48922?

Yes. org.jenkins-ci.plugins:credentials-binding (Maven): upgrade to 725.ve52b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48922 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48922?

Check whether you run Jenkins Credentials Binding Plugin or org.jenkins-ci.plugins:credentials-binding (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48922 · Severity: high · CVSS 7.5 · Published 2026-05-27

The Jenkins Credentials Binding Plugin, which manages how secrets are handled during automated builds, contains a security flaw in how it processes file names. An attacker with low-level access could exploit this to write malicious files to sensitive locations on the server's filesystem. In certain configurations, this can allow the attacker to take full control of the Jenkins server and execute unauthorized commands.

Technologies: org.jenkins-ci.plugins:credentials-binding (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-48922 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48922 being exploited in the wild.
How severe is CVE-2026-48922?: High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?: Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_, 720.v3f6decef43ea_ and earlier; org.jenkins-ci.plugins:credentials-binding (Maven) <= 720.v3f6decef43ea, ECOSYSTEM:introduced=0,fixed=725.ve52b.
Is there a fix for CVE-2026-48922?: Yes. org.jenkins-ci.plugins:credentials-binding (Maven): upgrade to 725.ve52b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48922 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48922?: Check whether you run Jenkins Credentials Binding Plugin or org.jenkins-ci.plugins:credentials-binding (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jenkins-ci.plugins:credentials-binding (Maven): upgrade to 725.ve52b or later

# set org.jenkins-ci.plugins:credentials-binding to 725.ve52b in your pom.xml or build.gradle

Technical details

A path traversal vulnerability (CWE-22) exists in the Jenkins Credentials Binding Plugin due to improper sanitization of file names for 'file' and 'zip file' credentials. An attacker with permission to provide credentials to a job can supply a crafted filename containing traversal sequences (e.g., ../) to write files to arbitrary locations on the node's filesystem. If the Jenkins environment allows low-privileged users to configure these credentials for jobs running on the built-in node, this primitive can be escalated to Remote Code Execution (RCE). This issue is an incomplete fix for a previous vulnerability (SECURITY-3672) and is resolved in version 725.ve52b_2328a_fde.

Affected products

Jenkins Credentials Binding Plugin <= 720.v3f6decef43ea_

Identifiers

CVE-2026-48922
GHSA-fxxf-w25w-mcx2

Timeline

2026-05-27: disclosed
2026-05-27: advisory
2026-07-01: patched

References

https://www.jenkins.io/security/advisory/2026-05-27/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.