Read the docs
TI-2026-36185 Aliases CVE-2026-48926GHSA-p8jh-4p5p-2rfp

Improper privilege management in Jenkins Job Import Plugin

Priority LOW 19CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:job-import-plugin (Maven): 143.145.v48f9a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Job Import Pluginup to 143.v044a_2e819b_27—No fix listedCNA
—org.jenkins-ci.plugins:job-import-plugin (Maven)before 143.145.v48f9a143.145.v48f9aPatch availableGHSA-p8jh-4p5p-2rfp
  • Jenkins Job Import Plugin VendorJenkins Affected up to 143.v044a_2e819b_27 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:job-import-plugin (Maven) Vendor— Affected before 143.145.v48f9a Fixed in 143.145.v48f9a Patch available GHSA-p8jh-4p5p-2rfp

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:job_import:*:*:*:*:*:jenkins:*:*up to 122.v35289550f1e6VulnerableJenkins
cpe:2.3:a:jenkins:job_import:143.v044a_2e819b_27:*:*:*:*:jenkins:*:*143.v044a_2e819b_27VulnerableJenkins
  • cpe:2.3:a:jenkins:job_import:*:*:*:*:*:jenkins:*:* Versions up to 122.v35289550f1e6 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:job_import:143.v044a_2e819b_27:*:*:*:*:jenkins:*:* Versions 143.v044a_2e819b_27 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-p8jh-4p5p-2rfp org.jenkins-ci.plugins:job-import-plugin (Maven) Fixed in 143.145.v48f9a Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48926
  2. 2026-10-03 Alias added: GHSA-p8jh-4p5p-2rfp

References

Advisory 2

Other 1

  • TI-2019-15860 XML external entity injection in Jenkins Job Import Plugin CVSS 3.0CRITICAL 9.1
  • TI-2019-15861 Cross-site request forgery in Jenkins Job Import Plugin CVSS 3.0HIGH 8.8
  • TI-2019-15862 Cross-site request forgery in Jenkins Job Import Plugin CVSS 3.0MEDIUM 5.3
  • TI-2022-21208 Missing authorization in Jenkins Job Import Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences