GitHub Advisoryadvisory · Maven

GHSA-p8jh-4p5p-2rfp Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

MEDIUM Published 2026-05-27 Modified 2026-07-01 Official page ↗
Aliases
CVE-2026-48926
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:job-import-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269
Reviewed
2026-07-01

Affected packages

• Maven org.jenkins-ci.plugins:job-import-plugin: < 143.145.v48f9a → fixed in 143.145.v48f9a

Description

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. An enumeration of credentials IDs in Job Import Plugin 143.145.v48f9a_a_6ff384 requires Job Import/Import Jobs permission.

Related

Alias · CVE (1)

  • CVE-2026-48926 Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References