CVE-2026-84676 Overview
CVE-2026-84676 affects the Jenkins Parameterized Remote Trigger Plugin version 3.2.2 and earlier. The plugin stores authentication tokens unencrypted in job config.xml files on the Jenkins controller. Users with Item/Extended Read permission or direct file system access to the Jenkins controller can view these tokens in plaintext. The weakness maps to [CWE-311] Missing Encryption of Sensitive Data. Exposure of these tokens allows attackers to authenticate to remote Jenkins instances configured for parameterized triggers, potentially pivoting into connected build infrastructure.
Critical Impact
Plaintext token disclosure enables authenticated attackers or file system readers to steal credentials used for triggering builds on remote Jenkins controllers.
Affected Products
- Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier
- Jenkins controllers hosting affected plugin configurations
- Downstream Jenkins instances referenced by the plugin
Discovery Timeline
- 2026-09-02 - CVE-2026-84676 published to NVD
- 2026-09-02 - Jenkins Security Advisory SECURITY-3800 released
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84676
Vulnerability Analysis
The Parameterized Remote Trigger Plugin is used to invoke builds on remote Jenkins controllers from a local job. It accepts an authentication token that identifies the caller to the remote instance. Instead of encrypting this secret using the Jenkins credentials subsystem, the plugin persists the value directly into the job's config.xml. Any principal that can read this file obtains the token verbatim. Two distinct read paths exist: Jenkins users granted Item/Extended Read, and operating system accounts with file system access to $JENKINS_HOME/jobs/<job>/config.xml.
Root Cause
The plugin fails to wrap the token field with the Secret type that Jenkins provides for at-rest encryption. Fields typed as Secret are serialized using the controller's hudson.util.Secret key, producing an encrypted value in config.xml. Because the token is stored as a plain string, no confidentiality controls apply to the stored data.
Attack Vector
An attacker with low-privileged authenticated access and Item/Extended Read permission can retrieve the token by viewing the raw job configuration. An attacker with host-level access to the controller can read the file directly. The stolen token can then be replayed against the remote Jenkins instance to trigger builds, inject parameters, or chain into pipeline abuse.
No verified exploitation code is published. Refer to the Jenkins Security Advisory SECURITY-3800 for technical details.
Detection Methods for CVE-2026-84676
Indicators of Compromise
- Unexpected reads of $JENKINS_HOME/jobs/*/config.xml by non-administrative OS accounts
- Anomalous build triggers on remote Jenkins controllers from unfamiliar source addresses
- Access to the Jenkins REST endpoint /job/<name>/config.xml by accounts holding only Item/Extended Read
Detection Strategies
- Audit Jenkins access logs for config.xml GET requests correlated to user identity and permission set
- Inventory installed plugin versions and flag parameterized-remote-trigger at or below 3.2.2
- Grep config.xml files for the plugin's token XML element to identify plaintext secrets pending rotation
Monitoring Recommendations
- Forward Jenkins controller audit logs and file access telemetry to a centralized SIEM for correlation
- Alert on new or modified Item/Extended Read grants across folders and jobs
- Monitor authentication events on remote Jenkins instances for tokens tied to migrated or decommissioned jobs
How to Mitigate CVE-2026-84676
Immediate Actions Required
- Upgrade the Parameterized Remote Trigger Plugin to a fixed release above 3.2.2 per SECURITY-3800
- Rotate every authentication token previously stored by the plugin on both source and remote controllers
- Review and reduce Item/Extended Read permission assignments to the minimum required set
- Restrict operating system access to $JENKINS_HOME to the Jenkins service account and administrators
Patch Information
Jenkins published fix guidance in Jenkins Security Advisory SECURITY-3800. Apply the plugin update through the Jenkins Update Center, then restart the controller. Rotating tokens after the upgrade is required because existing plaintext values remain valid until changed.
Workarounds
- Remove the plugin from controllers where remote triggering is not required
- Replace static tokens with short-lived credentials sourced from the Jenkins Credentials Plugin
- Enforce file system ACLs that block read access to config.xml for all non-service accounts
# Identify affected plugin version and locate plaintext tokens
ls $JENKINS_HOME/plugins/parameterized-remote-trigger/
grep -RIn "<token>" $JENKINS_HOME/jobs/ 2>/dev/null
chown -R jenkins:jenkins $JENKINS_HOME
chmod -R go-rwx $JENKINS_HOME/jobs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
