Description

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T16:17:32.233Z",
  "pubdate": "2026-09-02T16:17:32.233Z",
  "executiveSummary": "The Jenkins Parameterized Remote Trigger Plugin, in versions 3.2.2 and earlier, suffers from a sensitive information disclosure vulnerability due to insecure credential storage.\nThe plugin stores authentication tokens in plain text within the job config.xml files located on the Jenkins controller.\nThis vulnerability exposes sensitive credentials to any user or entity with Item/Extended Read permissions or direct file system access to the Jenkins controller environment.\nThe primary risk involves the unauthorized extraction of tokens, which can facilitate unauthorized remote triggers or unauthorized access to integrated systems if those tokens are reused elsewhere.\nThe vulnerability does not require complex exploit code; rather, it hinges on the improper handling of sensitive data at rest.\nImpact includes a significant breach of confidentiality regarding authentication material, potentially allowing an attacker to impersonate legitimate services or users to trigger unauthorized builds or interact with external APIs.",
  "technicalDetails": "The vulnerability stems from the plugin's failure to utilize the Jenkins built-in secret storage mechanisms (e.g., Secret or Credentials API) when persisting configuration data.\nWhen a user configures a job to use the Parameterized Remote Trigger Plugin, the authentication token provided by the user is serialized into the job's config.xml file residing on the controller's file system without any form of encryption or obfuscation.\nBecause Jenkins stores job configurations as XML files on the disk, the lack of cryptographic protection renders these tokens readable in plain text to any process or user with access to the underlying file system.\nFurthermore, the Jenkins security model allows users with Item/Extended Read permissions to access configuration data via the Jenkins API or web interface, enabling them to retrieve the plaintext token through standard configuration viewing mechanisms.\nAttack flow: An attacker with low-level, non-administrative read permissions targets a specific Jenkins job configured with the vulnerable plugin. By querying the job's configuration through the Jenkins REST API or by navigating the web interface, the attacker accesses the raw XML content. Because the token is stored as a clear-text attribute within the job definition, the attacker extracts the credential immediately.\nPost-exploitation, an attacker can utilize the harvested token to perform unauthorized remote trigger requests against downstream Jenkins instances or integrated external systems that rely on the same token for authentication. This effectively bypasses the intended security controls of the remote service.\nThe vulnerability affects all instances running the Parameterized Remote Trigger Plugin version 3.2.2 and earlier. The root cause is the deviation from the Jenkins security best practices for handling secrets, which mandate the use of the 'Secret' field type in data binding, ensuring that sensitive information is properly handled and encrypted at rest by the Jenkins controller."
}