CVE-2026-92133
Quick assessment
Affected
Jenkins Project Jenkins GitLab Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Jenkins GitLab 插件 1.2149.vcfc32c82b_f7f 及更早版本，在缓存用于备用 GitLab API 令牌凭据的 GitLab API 客户端时，仅基于凭据 ID 生成缓存键，而未包含凭据所属的文件夹路径。这导致拥有“Item/Configure”权限的攻击者能够访问他们本不应有权使用的 GitLab API 令牌凭据。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Jenkins Project | Jenkins GitLab Plugin | ≤ 1.2149.vcfc32c82b_f7f |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92133
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Jenkins Project | Jenkins GitLab Plugin | 0 ~ 1.2149.vcfc32c82b_f7f | - |
|
II. Public POCs for CVE-2026-92133
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92133
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92133 (1)
Same Patch Batch · Jenkins Project · 2026-09-16 · 20 CVEs total
| CVE-2026-92132 | Jenkins Gradle Plugin低版本Develocity访问密钥泄露 | |
| CVE-2026-92122 | Jenkins Script Security Plugin 1415.v9af9b3ac253d及以下版本沙箱逃逸漏洞 | |
| CVE-2026-92124 | Jenkins脚本安全插件1415.v9af9b3ac253d前存在沙箱逃逸漏洞 | |
| CVE-2026-92123 | Jenkins Script Security Plugin 低版本空值接收者沙箱绕过 | |
| CVE-2026-92125 | Jenkins Script Security插件沙箱逃逸漏洞 | |
| CVE-2026-92127 | Jenkins脚本安全插件1415及之前版本远程代码执行 | |
| CVE-2026-92126 | Jenkins Script Security插件沙箱绕过漏洞 | |
| CVE-2026-92128 | Jenkins Script Security插件1415.09af9b3ac253d及更早版本远程代码执行 | |
| CVE-2026-92130 | Jenkins Pipeline插件凭证泄露漏洞 | |
| CVE-2026-92129 | Jenkins插件1415版沙箱绕过漏洞 | |
| CVE-2026-92141 | Jenkins Keycloak插件2.4.1重定向钓鱼漏洞 | |
| CVE-2026-92131 | Groovy Libraries 805.va_fc79344957d 路径遍历漏洞 | |
| CVE-2026-92134 | Jenkins Warnings 13.10258版存储型XSS漏洞 | |
| CVE-2026-92135 | Jenkins Coverage插件≤3.3358存储型XSS漏洞 | |
| CVE-2026-92136 | Jenkins 5.6.4 前未转义CWE致存储型XSS漏洞 | |
| CVE-2026-92137 | Jenkins Robot Framework 6.2.2前路径校验缺失致RCE | |
| CVE-2026-92138 | Jenkins Bitbucket插件≤6.0.1 OAuth令牌劫持 | |
| CVE-2026-92140 | Jenkins Gitee插件存储型XSS漏洞 | |
| CVE-2026-92139 | Jenkins Bitbucket插件4.0.1前凭证泄露 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-92133
No comments yet