Executive brief
Jenkins Pipeline: Multibranch Plugin is a widely-used plugin for managing CI/CD pipelines across multiple Git branches. The plugin incorrectly handles credentials lookup in the resol step, allowing users with configuration permissions to access sensitive credentials beyond their authorized scope. This could lead to unauthorized disclosure of API keys, access tokens, and other secrets used in pipeline deployments.
Technical details
The vulnerability is a credentials context bypass in the resolveScm Pipeline step. The affected plugin versions (841.vec5b_9e1806ec and earlier) fail to set the appropriate security context when performing credentials lookup, allowing attackers with Item/Configure permission to retrieve credentials they are not entitled to access. The issue is present in the SCM resolution mechanism and requires existing configuration-level permissions to exploit. Jenkins has released patched versions that properly enforce credential access controls during the resolution process.
Affected products
- Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: Jenkins Security Advisory 2026-09-16