CVE-2026-84676 in Parameterized Remote Trigger Plugin
Summary
by MITRE • 09/02/2026
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Jenkins Parameterized Remote Trigger Plugin versions 3.2.2 and prior represents a critical failure in credential management, specifically involving the storage of authentication tokens within job configuration files. This plugin allows users to trigger builds via remote HTTP requests using specific parameters, which often require secure token-based authentication to prevent unauthorized execution. The core technical flaw lies in the implementation detail where these sensitive security credentials are persisted as plaintext strings directly inside the job config.xml file on the Jenkins controller node. By failing to encrypt or obfuscate these tokens during storage, the plugin exposes a significant attack surface that undermines the confidentiality of access controls established by administrators and developers who rely on this mechanism for secure automation workflows.
From an operational perspective, the impact of this vulnerability is severe because it allows any user with Item/Extended Read permission to view job configurations within Jenkins. In many enterprise environments, read permissions are granted broadly to facilitate collaboration and monitoring, meaning that a large number of internal users can inadvertently or maliciously extract these plaintext tokens. Furthermore, if an attacker gains file system access to the Jenkins controller through another vector, such as a separate remote code execution vulnerability or misconfigured server settings, they can directly scrape all stored tokens from the configuration files without needing any specific application-level permissions. This effectively neutralizes the security boundary provided by token-based authentication, turning what should be secret credentials into publicly accessible data within the context of authorized users.
This flaw aligns with CWE-312, which classifies issues related to cleartext storage of sensitive information, and falls under MITRE ATT&CK technique T1552.004 for Unsecured Credentials in Configuration Files. The exposure of these tokens can lead to unauthorized build executions, potential code injection during the build process if the token is used to trigger pipelines that fetch external resources, or lateral movement within the CI/CD infrastructure if those tokens are reused across other services. Attackers leveraging this weakness could manipulate pipeline outcomes, steal source code artifacts, or use the compromised credentials to escalate privileges by triggering administrative jobs that require elevated permissions but rely on the same token validation logic.
To mitigate this vulnerability, organizations must immediately upgrade the Jenkins Parameterized Remote Trigger Plugin to version 3.2.3 or later, where the developers have addressed the storage mechanism to ensure tokens are encrypted or handled via secure credential stores rather than plain text in configuration files. In addition to upgrading, administrators should audit existing job configurations for any residual plaintext tokens and rotate all exposed credentials immediately, as they must be assumed compromised due to their prior exposure to users with read access. Implementing stricter permission models that limit Item/Extended Read privileges to only those who absolutely require them can also reduce the blast radius of this issue while migration efforts are underway. Regular security audits of configuration files and adherence to least-privilege principles in CI/CD pipeline design are essential to prevent similar credential exposure incidents in the future.