CVE-2026-84674: Jenkins XebiaLabs Plugin Info Disclosure

CVE-2026-84674 Overview

CVE-2026-84674 is a missing authorization vulnerability in the Jenkins XebiaLabs XL Deploy Plugin. Versions 26.1.0 and earlier fail to perform proper permission checks on an endpoint that exposes credentials metadata. Attackers with Overall/Read permission can enumerate credentials IDs of credentials stored in Jenkins. The flaw is classified under CWE-862: Missing Authorization.

Enumerated credentials IDs enable follow-on attacks that reference those IDs through other vulnerabilities or plugin misuse. The issue is documented in the Jenkins Security Advisory SECURITY-3948.

Critical Impact
Authenticated Jenkins users with minimal read permissions can enumerate stored credentials IDs, aiding lateral movement and secret-targeting attacks against CI/CD infrastructure.

Affected Products

Jenkins XebiaLabs XL Deploy Plugin versions 26.1.0 and earlier
Jenkins controllers with the plugin installed and unauthenticated Overall/Read grants
CI/CD environments integrating XebiaLabs XL Deploy via the affected plugin

Discovery Timeline

2026-09-02 - CVE-2026-84674 published to NVD
2026-09-02 - Jenkins publishes Security Advisory SECURITY-3948
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84674

Vulnerability Analysis

The XebiaLabs XL Deploy Plugin exposes a form-related HTTP endpoint that returns credentials metadata used to populate credential selection dropdowns in Jenkins jobs. In versions 26.1.0 and earlier, this endpoint does not enforce sufficient permission checks before returning data. Any authenticated user holding only Overall/Read permission can invoke the endpoint and retrieve a list of credentials IDs.

Credentials IDs are not themselves secret values, but they act as handles referencing stored secrets such as API tokens, SSH keys, and passwords. Attackers use enumerated IDs in conjunction with other Jenkins vulnerabilities that reference credentials by ID to extract secret material or move laterally into connected systems.

Root Cause

The root cause is a missing authorization check on a plugin HTTP route. The endpoint should require a higher permission level, typically Item/Configure or Credentials/View, before returning credentials metadata. The plugin instead relies on the default authenticated context, which grants access to any user with Overall/Read.

Attack Vector

Exploitation requires network access to the Jenkins controller and a valid account with Overall/Read permission. An attacker sends an authenticated HTTP request to the plugin's credentials-listing endpoint and parses the response to extract credentials IDs. No user interaction is required.

No verified proof-of-concept code has been published. Refer to the Jenkins Security Advisory SECURITY-3948 for technical details.

Detection Methods for CVE-2026-84674

Indicators of Compromise

Repeated authenticated HTTP requests from low-privilege Jenkins accounts targeting XebiaLabs XL Deploy Plugin form-validation or credential-listing endpoints
Unexpected access patterns to plugin URLs by users who do not configure jobs using XL Deploy
Subsequent job configuration changes or credential-referencing activity following enumeration attempts

Detection Strategies

Audit Jenkins access logs for requests to XL Deploy plugin endpoints originating from accounts with only Overall/Read permission
Correlate credential ID enumeration events with subsequent job creation or modification events that reference those IDs
Review Jenkins role assignments to identify accounts with Overall/Read that should not have plugin access

Monitoring Recommendations

Forward Jenkins controller access logs and audit logs to a centralized SIEM for query and alerting
Alert on high-volume or scripted access from a single Jenkins user to plugin form endpoints
Track changes to installed plugin versions to confirm patching status across all Jenkins controllers

How to Mitigate CVE-2026-84674

Immediate Actions Required

Identify all Jenkins controllers with the XebiaLabs XL Deploy Plugin installed and record installed versions
Restrict Overall/Read permission to trusted users until the plugin is upgraded to a fixed release
Rotate credentials stored in Jenkins if unauthorized enumeration is suspected

Patch Information

At the time of publication, the Jenkins Security Advisory SECURITY-3948 lists no fixed version of the XebiaLabs XL Deploy Plugin. Administrators should monitor the advisory for updates and apply a fixed release as soon as it is published.

Workarounds

Remove the XebiaLabs XL Deploy Plugin from Jenkins controllers where it is not actively used
Apply matrix-based or role-based authorization to reduce the number of users with Overall/Read
Enforce authentication and disable anonymous read access on Jenkins controllers exposed to internal networks

bash

# Verify installed XL Deploy Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i xldeploy