Jenkins Gitlab Plugin CVEs and Security Vulnerabilities

CVE-2026-92133

GitLab API Token Exposure via Jenkins GitLab Plugin Cache

Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Gitlab Plugin

CVE-2026-84664

GitLab Plugin Global Configuration Overwrite via Stapler Data Binding

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators.