Jenkins Parameterized Remote Trigger Plugin CVEs and Security Vulnerabilities

CVE-2026-84676

Tokens Stored Unencrypted in Jenkins Parameterized Remote Trigger Plugin

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Parameterized Remote Trigger Plugin

CVE-2026-70438

Credential Enumeration via Missing Permission in Jenkins Parameterized Remote Trigger Plugin

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.