Executive brief
The Jenkins GitLab Plugin caches API credentials in a way that does not properly isolate them by folder scope, allowing attackers with job configuration permissions to access GitLab API tokens they should not have access to. This could lead to unauthorized access to GitLab repositories and data associated with those tokens.
Technical details
The GitLab Plugin caches GitLab API client instances using a cache key derived only from the credentials ID, omitting the folder context in which the credentials are resolved. This permits credential scope bypass attacks: an attacker with Item/Configure permission can retrieve API client objects cached for credentials in other folders, gaining access to GitLab API tokens they are not entitled to use. The vulnerability affects Jenkins GitLab Plugin version 1.2149.vcfc32c82b_f7f and earlier. The fix incorporates folder information into the cache key to properly isolate cached credentials by scope.
Affected products
- Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory