Executive brief
The Jenkins XebiaLabs XL Deploy Plugin is used to integrate deployment orchestration into Jenkins CI/CD pipelines. A permission bypass vulnerability allows users with basic read-only access to enumerate and list credential IDs stored in Jenkins, potentially revealing sensitive credential references used in automated deployments without the need for administrative privileges.
Technical details
The Jenkins XebiaLabs XL Deploy Plugin versions 26.1.0 and earlier contain missing permission checks that fail to properly validate authorization before exposing credential enumeration endpoints. An attacker with Overall/Read permission (typically a low-privilege account in Jenkins) can access these endpoints to enumerate and list credential IDs stored in Jenkins. This is an information disclosure vulnerability requiring only network access to Jenkins and a valid low-privilege account; no authentication bypass is required. The vulnerability is resolved in plugin version 26.1.1 and later.
Affected products
- CloudBees XL Deploy Plugin 26.1.0 and earlier
Timeline
- 2026-09-02: disclosed