Executive brief
Jenkins, a widely-used automation server that stores configuration and secrets for CI/CD pipelines, fails to encrypt sensitive credentials when job configurations are uploaded via API. These plaintext secrets remain stored on disk and can be read by users with basic read permissions or anyone with file system access to the Jenkins controller, exposing critical credentials used for deployment and integration with external systems.
Technical details
Jenkins stores job configurations in XML files on disk and allows updates via POST config.xml submissions. The vulnerability (CWE-311: Missing Encryption of Sensitive Data) occurs because Jenkins writes submitted config.xml to disk as-is during processing, without first encrypting secret fields. Subsequent GET config.xml responses serve the file directly from disk, exposing plaintext credentials. The attack requires no authentication (network vector) but does require an attacker to either have Item/Extended Read permission on a job or file system access to the Jenkins controller. The vulnerability was fixed in versions 2.568 and LTS 2.555.3, which now deserialize and re-serialize the configuration (causing automatic encryption of secrets) before persisting to disk.
Affected products
- Jenkins Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; 2.556–2.567
Timeline
- 2026-06-10: disclosed: Vulnerability disclosed in Jenkins Security Advisory 2026-06-10
- 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released with fix