CVE-2026-92130
Quick assessment
Affected
Jenkins Project Jenkins Pipeline: Multibranch Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： Jenkins Pipeline: Multibranch Plugin 版本 841.vec5b_9e1806ec 及更早版本在 Pipeline 步骤中未正确设置凭据查找所需的上下文，这使得拥有“Item/Configure”权限的攻击者能够访问并获取其本无权查看的凭据。 --- 关键术语对照说明： Multibranch Plugin：多分支插件 resolveScm：解析 SCM（源代码管理）步骤 credentials lookup context：凭据查找上下文 Item/
Possible ATT&CK Techniques 1 AI
T1550 · Use Alternate Authentication MaterialAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Jenkins Project | Jenkins Pipeline: Multibranch Plugin | ≤ 841.vec5b_9e1806ec |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92130
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins Project | Jenkins Pipeline: Multibranch Plugin | 0 ~ 841.vec5b_9e1806ec | - |
|
II. Public POCs for CVE-2026-92130
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92130
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92130 (1)
Same Patch Batch · Jenkins Project · 2026-09-16 · 20 CVEs total
| CVE-2026-92131 | Groovy Libraries 805.va_fc79344957d 路径遍历漏洞 | |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9af9b3ac253d及以下版本沙箱逃逸漏洞 | |
| CVE-2026-92124 | Jenkins脚本安全插件1415.v9af9b3ac253d前存在沙箱逃逸漏洞 | |
| CVE-2026-92123 | Jenkins Script Security Plugin 低版本空值接收者沙箱绕过 | |
| CVE-2026-92125 | Jenkins Script Security插件沙箱逃逸漏洞 | |
| CVE-2026-92127 | Jenkins脚本安全插件1415及之前版本远程代码执行 | |
| CVE-2026-92126 | Jenkins Script Security插件沙箱绕过漏洞 | |
| CVE-2026-92128 | Jenkins Script Security插件1415.09af9b3ac253d及更早版本远程代码执行 | |
| CVE-2026-92129 | Jenkins插件1415版沙箱绕过漏洞 | |
| CVE-2026-92132 | Jenkins Gradle Plugin低版本Develocity访问密钥泄露 | |
| CVE-2026-92141 | Jenkins Keycloak插件2.4.1重定向钓鱼漏洞 | |
| CVE-2026-92133 | Jenkins GitLab Plugin 1.2149及之前版本凭证缓存访问漏洞 | |
| CVE-2026-92134 | Jenkins Warnings 13.10258版存储型XSS漏洞 | |
| CVE-2026-92135 | Jenkins Coverage插件≤3.3358存储型XSS漏洞 | |
| CVE-2026-92136 | Jenkins 5.6.4 前未转义CWE致存储型XSS漏洞 | |
| CVE-2026-92137 | Jenkins Robot Framework 6.2.2前路径校验缺失致RCE | |
| CVE-2026-92138 | Jenkins Bitbucket插件≤6.0.1 OAuth令牌劫持 | |
| CVE-2026-92140 | Jenkins Gitee插件存储型XSS漏洞 | |
| CVE-2026-92139 | Jenkins Bitbucket插件4.0.1前凭证泄露 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-92130
No comments yet