CVE-2026-84674: Vulnerability in Jenkins Project Jenkins XebiaLabs XL Deploy Plugin

CVE-2026-84674 describes a missing permission check vulnerability in Jenkins XebiaLabs XL Deploy Plugin versions 26.1.0 and earlier. Attackers who have Overall/Read permission in Jenkins can enumerate the IDs of credentials stored in Jenkins. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.4 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity at a low level without affecting availability. No official patch or remediation guidance is currently provided by the vendor.

An attacker with Overall/Read permission can enumerate credential IDs, potentially aiding further attacks by revealing credential identifiers. However, the vulnerability does not allow direct credential access, modification, or denial of service. The confidentiality and integrity impacts are low, and availability is unaffected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Overall/Read permissions to trusted users only to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.