Executive brief
The Jenkins Gitee Plugin, which integrates Jenkins with the Gitee code hosting platform, contains a security flaw in how it checks user permissions. This flaw allows users who have general configuration privileges to see the identification labels of credentials stored in the system, even if they shouldn't have access to specific projects. While this does not expose the actual passwords or secret keys, it reveals metadata about the security credentials used within the organization.
Technical details
A vulnerability exists in the Jenkins Gitee Plugin due to an improper permission check in an HTTP endpoint. Specifically, users possessing the global 'Item/Configure' permission can list and enumerate the IDs of credentials stored in Jenkins, even if they lack the specific 'Item/Configure' permission for individual jobs. This is a metadata leakage vulnerability where credential identifiers are exposed, though the underlying secrets themselves are not directly revealed through this specific flaw. The issue affects version 1288.v18b_deb_c9069b_ and all prior versions.
Affected products
- Jenkins Project Gitee Plugin 1288.v18b_deb_c9069b_ and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory