Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3783 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Jun 2026, 14:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jenkins
Jenkins job Import |
|
| CPE | cpe:2.3:a:jenkins:job_import:*:*:*:*:*:jenkins:*:* cpe:2.3:a:jenkins:job_import:143.v044a_2e819b_27:*:*:*:*:jenkins:*:* |
|
| References | () https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3783 - Vendor Advisory |
27 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-269 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
27 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 15:16
Updated : 2026-06-02 14:49
NVD link : CVE-2026-48926
Mitre link : CVE-2026-48926
CVE.ORG link : CVE-2026-48926
JSON object : View
Products Affected
jenkins
- job_import
CWE
CWE-269
Improper Privilege Management