CVE-2026-84674 PUBLISHED

Assigner: jenkins
Reserved: 01.09.2026 Published: 02.09.2026 Updated: 02.09.2026

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Product Status

Vendor Jenkins Project
Product Jenkins XebiaLabs XL Deploy Plugin
Versions Default: unaffected
  • affected from 0 to 26.1.0 (incl.)

References