Executive brief
The Parameterized Remote Trigger Plugin for Jenkins stores authentication tokens in plain text within job configuration files. Users with read permissions to job configurations or access to the Jenkins controller file system can view these tokens, potentially using them to trigger remote jobs or access external systems with the compromised credentials.
Technical details
The vulnerability is a credential storage issue in the Parameterized Remote Trigger Plugin version 3.2.2 and earlier. The plugin stores authentication tokens unencrypted directly in job config.xml files on the Jenkins controller. Attackers with Item/Extended Read permission on Jenkins jobs, or those with file system access to the Jenkins controller, can read these configuration files and extract the exposed tokens. The tokens can then be used to authenticate to remote systems or trigger unauthorized job executions. The fix involves encrypting sensitive credentials before storage in configuration files.
Affected products
- Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier
Timeline
- 2026-09-02: disclosed