Executive brief
The Jenkins GitLab Plugin allows administrators to configure a central connection to GitLab with API tokens for secure integration. A flaw in Stapler data binding allows attackers to overwrite this configuration and redirect it to an attacker-controlled URL, enabling credential theft while still using the legitimate API tokens configured by administrators.
Technical details
The Jenkins GitLab Plugin versions 1.9.16 and earlier fail to restrict which types can be instantiated via Stapler form data binding. An attacker with Overall/Read permission can submit a crafted form to overwrite the global GitLab connection configuration, redirecting API calls to an attacker-specified URL. This allows credential interception: GitLab API tokens already configured by administrators will be transmitted to the attacker's server when Jenkins communicates with what it believes is the legitimate GitLab instance. The vulnerability stems from Stapler's form binding not validating that instantiated types match the expected field type. A fix is available in Jenkins 2.580 and LTS 2.568.3, which restrict form-instantiable types to those compatible with the expected field type.
Affected products
- Jenkins GitLab Plugin 1.9.16 and earlier
Timeline
- 2026-09-02: disclosed