CVE-2026-92130: Jenkins Pipeline Privilege Escalation Flaw

CVE-2026-92130 Overview

CVE-2026-92130 affects the Jenkins Pipeline: Multibranch Plugin version 841.vec5b_9e1806ec and earlier. The plugin fails to set the appropriate context for credentials lookup in the resolveScm Pipeline step. Attackers holding Item/Configure permission can leverage this flaw to access credentials they are not entitled to use. The issue is tracked under CWE-863: Incorrect Authorization and disclosed in the Jenkins Security Advisory 2026-09-16.

Critical Impact
Authenticated users with Item/Configure permission can capture credentials outside their authorization scope, enabling lateral movement into source code management systems.

Affected Products

Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec
Jenkins Pipeline: Multibranch Plugin versions earlier than 841.vec5b_9e1806ec
Jenkins controllers using the resolveScm Pipeline step

Discovery Timeline

2026-09-16 - Jenkins publishes Security Advisory SECURITY-3729
2026-09-16 - CVE-2026-92130 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92130

Vulnerability Analysis

The Pipeline: Multibranch Plugin exposes the resolveScm step for retrieving source control configurations within Jenkins Pipelines. The plugin does not set the appropriate authentication context when performing credentials lookup during this step. As a result, the lookup is evaluated against a broader authorization scope than the requesting user should possess.

An attacker with Item/Configure permission can craft a Pipeline that invokes resolveScm with credential identifiers referencing secrets stored outside their permitted scope. The plugin returns and uses those credentials during SCM resolution, allowing the attacker to capture them.

Root Cause

The root cause is an incorrect authorization check, classified as [CWE-863]. Credentials lookups in Jenkins are expected to run under the identity of the requesting user or a similarly scoped context. The resolveScm step omits this context, causing Jenkins to consult credentials that the caller cannot legitimately access.

Attack Vector

Exploitation requires an authenticated Jenkins account with Item/Configure permission. The attacker constructs or edits a Pipeline definition that calls resolveScm with a target credential ID. During execution, the plugin resolves the SCM configuration using the unintended credential and exposes its contents to Pipeline logic under attacker control.

Refer to the Jenkins Security Advisory 2026-09-16 for the maintainer's technical description.

Detection Methods for CVE-2026-92130

Indicators of Compromise

Pipeline definitions invoking resolveScm with credential IDs the job owner does not normally use.
Audit log entries showing credential access from Pipelines run by users with only Item/Configure permission.
Unexpected SCM clone or fetch activity originating from Jenkins controllers using credentials outside the job's project scope.

Detection Strategies

Review Jenkins job configurations and Jenkinsfiles for use of the resolveScm step, correlating credential IDs with the requesting user's authorization scope.
Enable and monitor the Jenkins Credentials audit logs for lookups initiated by Pipeline steps.
Alert on anomalous SCM authentication events originating from Jenkins service accounts.

Monitoring Recommendations

Forward Jenkins controller logs, audit trail entries, and plugin version inventory to a centralized SIEM for correlation.
Track plugin version drift across Jenkins controllers to identify systems still running vulnerable Multibranch Plugin builds.
Monitor for creation of new Multibranch Pipeline jobs by non-administrator users and review their SCM configuration.

How to Mitigate CVE-2026-92130

Immediate Actions Required

Upgrade the Pipeline: Multibranch Plugin to the fixed release published in the Jenkins Security Advisory 2026-09-16.
Audit users granted Item/Configure permission and remove entitlements that are not required.
Review recent Pipeline runs that reference resolveScm and rotate any credentials that may have been exposed.

Patch Information

Jenkins addressed the flaw in the release documented under advisory SECURITY-3729. Administrators should apply the upgrade through the Jenkins Update Center or by deploying the fixed plugin .hpi artifact and restarting the controller.

Workarounds

Restrict Item/Configure permission to trusted maintainers using Jenkins role-based access control.
Scope credentials to individual folders or projects so that Multibranch jobs cannot enumerate secrets from unrelated scopes.
Disable or remove Multibranch jobs that rely on the resolveScm step until the plugin is upgraded.

bash

# Verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep workflow-multibranch