PT-2026-35914 · Jenkins · Credentials Binding Plugin+1

Ap4Sh + 3 · Published 2026-04-29 · Updated 2026-05-07 · CVE-2026-42520

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Credentials Binding Plugin versions prior to 719.v80e905ef14eb

Description Insufficient sanitization of file names for file and zip file credentials allows attackers who can provide credentials to a job to write files to arbitrary locations on the node filesystem. This can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.

Recommendations Update the plugin to a version later than 719.v80e905ef14eb .

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42520

GHSA-P2RF-WPXJ-MX2G

Affected Products

Credentials Binding Plugin

Jenkins

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42520 · Security Note
• https://osv.dev/vulnerability/GHSA-p2rf-wpxj-mx2g · Vendor Advisory
• https://jenkins.io/security/advisory/2026-04-29/#SECURITY-3672 · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://twitter.com/integ_sec/status/2052389265426829510 · Twitter Post
• https://twitter.com/CVEnew/status/2049594357217374239 · Twitter Post