CVE-2026-84676: Vulnerability in Jenkins Project Jenkins Parameterized Remote Trigger Plugin

CVE-2026-84676 describes a security weakness in Jenkins Parameterized Remote Trigger Plugin version 3.2.2 and earlier where authentication tokens are stored unencrypted within job configuration files (config.xml) on the Jenkins controller. This improper storage allows users with Item/Extended Read permissions or file system access to view these tokens, potentially compromising security. The vulnerability is classified under CWE-311 (Cleartext Storage of Sensitive Information). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized users with certain read permissions or file system access to view sensitive tokens stored in plaintext. This could lead to token disclosure, which may be leveraged to perform unauthorized actions depending on the token's privileges. However, the impact is limited by the requirement for at least Item/Extended Read permissions or file system access, and no integrity or availability impacts are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Jenkins controller file system and carefully manage user permissions to limit who can view job configurations. Monitor official Jenkins channels for updates regarding patches or mitigations.