CVE-2026-48926: Jenkins Job Import Plugin Info Disclosure

CVE-2026-48926 Overview

CVE-2026-48926 affects the Jenkins Job Import Plugin version 143.v044a_2e819b_27 and earlier. The plugin exposes an HTTP endpoint that fails to enforce a permission check before returning data. Attackers with Overall/Read permission can invoke this endpoint to enumerate credentials IDs of credentials stored in Jenkins.

The issue is tracked in Jenkins Security Advisory #SECURITY-3783 and classified under [CWE-269] Improper Privilege Management. While the disclosure does not directly leak credential secrets, the enumerated IDs enable follow-on attacks against other plugins or pipelines that consume credentials by ID.

Critical Impact

Authenticated users with minimal Overall/Read access can enumerate stored credentials IDs, providing reconnaissance data for subsequent attacks on Jenkins credentials and pipelines.

Affected Products

• Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier
• Jenkins controllers with the Job Import Plugin installed
• Environments allowing Overall/Read permission to untrusted users

Discovery Timeline

• 2026-05-27 - Jenkins publishes Security Advisory SECURITY-3783
• 2026-05-27 - CVE-2026-48926 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48926

Vulnerability Analysis

The Jenkins Job Import Plugin exposes functionality through HTTP endpoints registered with the Jenkins controller. One of these endpoints returns credentials IDs available within Jenkins to facilitate job import operations. The endpoint omits the required permission check, so any authenticated user holding Overall/Read permission can call it.

Credentials IDs in Jenkins are referenced by pipelines, freestyle jobs, and other plugins. Enumerating them provides attackers with a map of secrets stored on the controller, including service account references, API tokens, and SSH keys. This information accelerates lateral movement and credential-targeted attacks.

The vulnerability falls under [CWE-269] Improper Privilege Management. Network exploitation requires only low-privilege authentication and no user interaction, but discloses information without modifying integrity or availability.

Root Cause

The HTTP endpoint handler in the Job Import Plugin does not invoke a permission check such as Item.CREATE or Credentials.VIEW before returning data. Jenkins relies on plugin authors to gate sensitive endpoints with explicit permission assertions. The missing check allows the endpoint to default to the broader Overall/Read scope granted to authenticated users.

Attack Vector

An attacker authenticates to Jenkins with any account holding Overall/Read permission. The attacker sends an HTTP request to the vulnerable Job Import Plugin endpoint. The server returns the list of credentials IDs configured in Jenkins. The attacker uses these IDs to target other plugin vulnerabilities, craft malicious pipelines that reference the credentials, or perform social engineering against credential owners.

No exploit code or public proof-of-concept has been published as of the advisory date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-48926

Indicators of Compromise

• HTTP requests from low-privileged user accounts to Job Import Plugin endpoints on the Jenkins controller
• Unusual enumeration patterns where a single session queries job import endpoints repeatedly
• Subsequent unauthorized references to specific credentials IDs in newly created or modified jobs

Detection Strategies

• Review Jenkins access logs for requests to Job Import Plugin URLs originating from accounts that do not normally perform job imports
• Correlate Overall/Read user activity with credentials ID references appearing in pipeline definitions or REST API calls
• Audit installed plugin versions against the fixed release listed in Jenkins Security Advisory #SECURITY-3783

Monitoring Recommendations

• Forward Jenkins controller HTTP access logs and audit logs to a centralized logging platform for retention and analysis
• Alert on enumeration-style request patterns against /plugin/job-import-plugin/ paths
• Track changes to credentials configuration and pipeline definitions for unexpected credentials ID references

How to Mitigate CVE-2026-48926

Immediate Actions Required

• Inventory all Jenkins controllers and identify installations of the Job Import Plugin at version 143.v044a_2e819b_27 or earlier
• Restrict Overall/Read permission to trusted users only until the plugin is updated
• Rotate credentials stored in Jenkins if logs indicate suspicious enumeration activity

Patch Information

Apply the fixed version of the Jenkins Job Import Plugin as described in Jenkins Security Advisory #SECURITY-3783. Verify plugin updates through the Jenkins Update Center and restart the controller if required by the plugin manager.

Workarounds

• Disable the Job Import Plugin if it is not actively used in the environment
• Tighten the Jenkins authorization strategy to limit Overall/Read to authenticated administrators and known service accounts
• Segment Jenkins controllers on networks accessible only through authenticated reverse proxies that enforce additional access controls

# Configuration example
# List installed plugins and versions via the Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:API_TOKEN \
  list-plugins | grep -i job-import

# Disable the plugin until patched
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:API_TOKEN \
  disable-plugin job-import-plugin -restart