Read the docs
TI-2025-33574 Aliases CVE-2025-53650GHSA-9768-hprv-crj5

Insufficiently protected credentials in Jenkins Credentials Binding Plugin

Priority LOW 32CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:credentials-binding (Maven): 687.689.v1a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Credentials Binding Pluginup to 687.v619cb_15e923f—No fix listedCNA
—org.jenkins-ci.plugins:credentials-binding (Maven)before 687.689.v1a687.689.v1aPatch availableGHSA-9768-hprv-crj5
  • Jenkins Credentials Binding Plugin VendorJenkins Affected up to 687.v619cb_15e923f Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:credentials-binding (Maven) Vendor— Affected before 687.689.v1a Fixed in 687.689.v1a Patch available GHSA-9768-hprv-crj5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:credentials_binding:*:*:*:*:*:jenkins:*:*up to 687.689.v1a_f775332fcVulnerableJenkins
  • cpe:2.3:a:jenkins:credentials_binding:*:*:*:*:*:jenkins:*:* Versions up to 687.689.v1a_f775332fc Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-9768-hprv-crj5 org.jenkins-ci.plugins:credentials-binding (Maven) Fixed in 687.689.v1a Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53650
  2. 2026-10-03 Alias added: GHSA-9768-hprv-crj5

References

Advisory 2

Other 2

  • TI-2026-36181 Improper input validation in Jenkins Credentials Binding Plugin CVSS 3.1HIGH 7.5
  • TI-2026-30803 Path traversal in Jenkins Credentials Binding Plugin CVSS 3.1HIGH 7.5
  • TI-2019-16035 Insufficiently protected credentials in Jenkins CVSS 3.1MEDIUM 6.5
  • TI-2020-02058 Insufficiently protected credentials in Jenkins Credentials Binding Plugin CVSS 3.1MEDIUM 6.5
  • TI-2022-05175 Missing authorization in Jenkins Credentials Binding Plugin CVSS 3.1MEDIUM 4.3
  • TI-2020-02059 Insufficiently protected credentials in Jenkins Credentials Binding Plugin CVSS 3.1MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences