Read the docs
TI-2024-26394 Aliases CVE-2024-39459GHSA-3cpq-rw36-cppv

Insecure storage of sensitive information in Jenkins Plain Credentials Plugin

Priority LOW 20CWE-922Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-922.

Summary

In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoded) on the Jenkins controller file system, where they can be viewed by users with access to the Jenkins controller file system (global credentials) or with Item/Extended Read permission (folder-scoped credentials).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.plugins:plain-credentials (Maven): 183.vaRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Plain Credentials Pluginup to 182.v468b_97b_9dcb_8—No fix listedCNA
—org.jenkins-ci.plugins:plain-credentials (Maven)before 183.va183.vaPatch availableGHSA-3cpq-rw36-cppv
  • Jenkins Plain Credentials Plugin VendorJenkins Affected up to 182.v468b_97b_9dcb_8 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:plain-credentials (Maven) Vendor— Affected before 183.va Fixed in 183.va Patch available GHSA-3cpq-rw36-cppv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:*up to 182.v468b_97b_9dcb_8VulnerableJenkins
  • cpe:2.3:a:jenkins:plain_credentials:*:*:*:*:*:jenkins:*:* Versions up to 182.v468b_97b_9dcb_8 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-3cpq-rw36-cppv org.jenkins-ci.plugins:plain-credentials (Maven) Fixed in 183.va Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39459
  2. 2026-10-03 Alias added: GHSA-3cpq-rw36-cppv

References

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences