Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Plain Credentials Plugin (org.jenkins-ci.plugins:plain-credentials) versions 182.v468b_97b_9dcb_8 and earlier are affected. In rare cases, when secret file credentials are created, file content that happens to match the format of an encrypted secret is stored only Base64 encoded on the Jenkins controller file system. Users with access to the controller file system, or with Item/Extended Read permission for folder-scoped credentials, can view these credentials. Upgrade to version 183.va_de8f1dd5a_2b_ or later, which no longer attempts decryption when creating secret file credentials.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 4.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.0042, the 36th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:13 UTC First seen by agentprime
- 31 Oct 2026, 15:13 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-3cpq-rw36-cppv
- OSV: GHSA-3cpq-rw36-cppv
- nvd.nist.gov/vuln/detail/CVE-2024-39459
- github.com/jenkinsci/plain-credentials-plugin/commit/ade8f1dd5a2bc69357995fd50baac56d73f80813
- github.com/jenkinsci/plain-credentials-plugin
- www.jenkins.io/security/advisory/2024-06-26/#SECURITY-2495
- www.openwall.com/lists/oss-security/2024/06/26/2