Skip to content
fr Sign in
4.3 Medium

CVE-2026-84676 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the…

Description

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Affected products and versions

Product Affected versions Fixed in
Jenkins Parameterized Remote Trigger Plugin 3.2 earliest → 3.2.2 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Jenkins Parameterized Remote Trigger Plugin

The 3 CVEs of Jenkins Parameterized Remote Trigger Plugin →
CVE-2026-70438 A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with… 4.3 Medium CVE-2020-2239 Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration… Not rated
Track this CVE