CVE-2026-70438 in Parameterized Remote Trigger Plugin
Summary
by MITRE • 08/05/2026
A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability resides within the Jenkins Parameterized Remote Trigger Plugin version 3.2.2 and earlier, where a critical missing permission check creates an unauthorized enumeration pathway for credential identifiers. The flaw specifically affects users who possess only the Overall/Read permission level, which typically should restrict them to viewing basic system information without accessing sensitive credential data. However, due to the absence of proper authorization validation in the plugin's credential enumeration functionality, these limited-privilege users can bypass normal security boundaries and discover credential IDs stored within the Jenkins instance.
The technical implementation of this vulnerability stems from insufficient input validation and access control mechanisms within the plugin's remote trigger processing logic. When the plugin handles parameterized remote triggers, it fails to verify whether the requesting user possesses adequate privileges before exposing credential identification information. This permission bypass allows attackers to systematically enumerate available credentials without requiring elevated privileges such as credentials management or administrative access. The vulnerability operates at the application layer and can be exploited through the Jenkins REST API or web interface, making it particularly dangerous in environments where multiple users have varying permission levels.
The operational impact of this vulnerability extends beyond simple information disclosure, as credential ID enumeration provides attackers with critical intelligence for subsequent exploitation attempts. Once an attacker identifies valid credential IDs, they can attempt brute force attacks against these specific credentials or combine this information with other vulnerabilities to escalate privileges within the Jenkins environment. The exposure of credential identifiers creates a pathway for privilege escalation attacks and increases the attack surface significantly, particularly in environments where Jenkins manages sensitive authentication tokens, API keys, or service account credentials.
Organizations should immediately upgrade to Jenkins Parameterized Remote Trigger Plugin version 3.2.3 or later, which includes the necessary permission checks to prevent unauthorized credential enumeration. System administrators should implement additional monitoring for suspicious API calls related to credential enumeration and establish network-level restrictions to limit access to Jenkins endpoints. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant concern under ATT&CK technique T1552.001 (Credentials from Password Stores). Security teams should also conduct comprehensive audits of all Jenkins plugins to identify similar permission bypass vulnerabilities and ensure proper access control implementations throughout the continuous integration/continuous deployment pipeline infrastructure.
The remediation process requires immediate patching of the affected plugin while maintaining proper principle of least privilege enforcement. Organizations should review their existing Jenkins security configurations and implement additional layers of protection including IP whitelisting, authentication hardening, and regular security scanning of their CI/CD environments to prevent similar vulnerabilities from emerging in other components of their automation infrastructure.