CVE-2026-42520: Vulnerability in Jenkins Project Jenkins Credentials Binding Plugin
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
AI Analysis
Technical Summary
CVE-2026-42520 is a vulnerability in the Jenkins Credentials Binding Plugin where file names for file and zip file credentials are not sanitized. This flaw enables an attacker who can supply credentials to a Jenkins job to write files arbitrarily on the node filesystem. The vulnerability can lead to remote code execution if Jenkins allows low-privileged users to configure file or zip file credentials for jobs executed on the built-in node. The affected versions include 719.v80e905ef14eb_ and earlier. No CVSS score or patch information is currently available.
Potential Impact
An attacker able to provide credentials to a Jenkins job can write files to arbitrary locations on the node filesystem, potentially leading to remote code execution. This risk is contingent on Jenkins being configured to allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until a fix is available, restrict the ability of low-privileged users to configure file or zip file credentials for jobs, and review job and credential configuration permissions carefully to limit exposure.
CVE-2026-42520: Vulnerability in Jenkins Project Jenkins Credentials Binding Plugin
Description
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-42520 is a vulnerability in the Jenkins Credentials Binding Plugin where file names for file and zip file credentials are not sanitized. This flaw enables an attacker who can supply credentials to a Jenkins job to write files arbitrarily on the node filesystem. The vulnerability can lead to remote code execution if Jenkins allows low-privileged users to configure file or zip file credentials for jobs executed on the built-in node. The affected versions include 719.v80e905ef14eb_ and earlier. No CVSS score or patch information is currently available.
Potential Impact
An attacker able to provide credentials to a Jenkins job can write files to arbitrary locations on the node filesystem, potentially leading to remote code execution. This risk is contingent on Jenkins being configured to allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until a fix is available, restrict the ability of low-privileged users to configure file or zip file credentials for jobs, and review job and credential configuration permissions carefully to limit exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jenkins
- Date Reserved
- 2026-04-28T09:24:35.048Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f20cdfcbff5d8610181a81
Added to database: 4/29/2026, 1:51:27 PM
Last enriched: 4/29/2026, 2:07:03 PM
Last updated: 4/30/2026, 3:48:57 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.