PT-2026-44015 · Jenkins · Credentials Binding Plugin

Mitchell Benjamin + 1 · CVE-2026-48922 · Published 2026-05-27 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Credentials Binding Plugin versions 720.v3f6decef43ea and earlier

Description Insufficient sanitization of file names for file and zip file credentials allows attackers who can provide credentials to a job to write files to arbitrary locations on the node filesystem. This path traversal issue can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.

Recommendations Update the Jenkins Credentials Binding Plugin to a version later than 720.v3f6decef43ea .

Fix

LPE

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2026-48922

GHSA-FXXF-W25W-MCX2

Affected Products

Credentials Binding Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-48922 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48922 · Vendor Advisory
• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3790 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxxf-w25w-mcx2 · Vendor Advisory
• https://github.com/jenkinsci/credentials-binding-plugin · Note
• https://twitter.com/dailycve/status/2060135643414405214 · Twitter Post
• https://t.me/CVEtracker/55127 · Telegram Post
• https://t.me/cveNotify/165039 · Telegram Post