CVE-2026-42520: Jenkins Credentials Binding RCE Flaw

CVE-2026-42520 Overview

CVE-2026-42520 affects the Jenkins Credentials Binding Plugin version 719.v80e905ef14eb_ and earlier. The plugin fails to sanitize file names for file and zip file credentials. Attackers who can provide credentials to a job can write files to arbitrary locations on the node filesystem. This path traversal weakness ([CWE-22]) can escalate to remote code execution when Jenkins permits low-privileged users to configure file or zip file credentials for jobs running on the built-in node. The flaw exposes Jenkins controllers to compromise through what should be a constrained credential management feature.

Critical Impact
Authenticated low-privileged users can write arbitrary files to the Jenkins built-in node, leading to remote code execution and full controller compromise.

Affected Products

Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier
Jenkins instances permitting low-privileged users to configure file or zip file credentials
Jenkins jobs executing on the built-in node with vulnerable plugin versions

Discovery Timeline

2026-04-29 - Jenkins publishes Security Advisory SECURITY-3672
2026-04-29 - CVE-2026-42520 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-42520

Vulnerability Analysis

The Jenkins Credentials Binding Plugin binds credentials defined in Jenkins to environment variables or files available to job build steps. For file and zip file credential types, the plugin writes the credential content to the agent or controller workspace using a file name supplied through the credential configuration.

The plugin does not sanitize these file names before writing. An attacker controlling the credential configuration can embed path traversal sequences such as ../ in the file name. The resulting write occurs outside the intended workspace directory at a location chosen by the attacker.

When the job executes on the Jenkins built-in node, attacker-controlled writes land on the controller filesystem. Writing into directories such as $JENKINS_HOME/init.groovy.d/ or replacing plugin files yields remote code execution under the Jenkins controller process.

The attack requires authenticated access with permission to configure credentials used by a job, which corresponds to the low privileges reflected in the vector. Exploitation complexity is higher because the target Jenkins instance must allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node.

Root Cause

The root cause is missing input validation on credential file name fields. The plugin treats the user-supplied file name as a trusted relative path and passes it directly to file write operations without normalizing or constraining the path to the intended workspace directory.

Attack Vector

An authenticated attacker with credential configuration rights creates a file or zip file credential whose file name contains directory traversal characters. The attacker then triggers a job that binds this credential while running on the built-in node. The plugin writes the credential payload to the attacker-chosen location on the controller, where it can be picked up by Jenkins startup hooks or other automatic execution paths.

No verified public exploit code is available. Refer to the Jenkins Security Advisory SECURITY-3672 for vendor technical details.

Detection Methods for CVE-2026-42520

Indicators of Compromise

Unexpected files written under $JENKINS_HOME, particularly within init.groovy.d/, plugins/, or users/ directories
Credential definitions whose file name fields contain ../, absolute paths, or other traversal sequences
Build logs showing file or zip file credential bindings executing on the built-in node from low-privileged users

Detection Strategies

Audit existing file and zip file credentials for non-standard file name values that include path separators or traversal patterns
Inspect Jenkins audit logs for credential creation and modification events performed by non-administrator accounts
Correlate job runs on the built-in node with recent credential configuration changes by low-privileged users

Monitoring Recommendations

Enable file integrity monitoring on $JENKINS_HOME and alert on writes outside expected workspace paths
Forward Jenkins controller process activity and filesystem telemetry to a centralized data lake for retrospective hunting
Alert on Groovy script creation in init.groovy.d/ and on unexpected modifications to installed plugin files

How to Mitigate CVE-2026-42520

Immediate Actions Required

Upgrade the Jenkins Credentials Binding Plugin to a version later than 719.v80e905ef14eb_ as identified in the vendor advisory
Restrict the Credentials/Create and Credentials/Update permissions to trusted administrators until patching is complete
Configure jobs that require file or zip file credentials to run on dedicated agents rather than the built-in node

Patch Information

Jenkins published the fix in Security Advisory SECURITY-3672 on 2026-04-29. The advisory identifies the patched plugin version and provides upgrade guidance. Review the Jenkins Security Advisory SECURITY-3672 for the exact fixed release and applicable backports.

Workarounds

Prohibit job execution on the built-in node by setting the controller executor count to zero and routing builds to isolated agents
Remove file and zip file credentials owned by low-privileged users and recreate them under administrator-managed credential stores
Apply Role-Based Access Control to limit which users can bind credentials in job configurations

bash

# Disable build execution on the Jenkins built-in node via Groovy script console
import jenkins.model.Jenkins
Jenkins.instance.setNumExecutors(0)
Jenkins.instance.save()