CVE-2018-1000142: Jenkins GitHub Pull Request Builder Plugin Local File System Access Vulnerability
Summary
CVE-2018-1000142: An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub c... Affects org.jenkins-ci.plugins:ghprb versions < 1.40.0. Fixed in 1.40.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins GitHub Pull Request Builder Plugin is a plugin for the Jenkins automation server that allows users to trigger builds on GitHub pull requests. It integrates with GitHub and provides functionality for building, testing, and deploying pull requests. This plugin is commonly used in software development workflows to automate the build and test process for pull requests.
Vulnerability Detail
An exposure of sensitive information vulnerability has been identified in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older. The vulnerability resides in the GhprbCause.java file and allows an attacker with local file system access to obtain GitHub credentials. This can lead to unauthorized access to GitHub repositories and sensitive information. The plugin used to store serialized objects containing the credentials on disk, but this behavior was changed in version 1.40.0 to prevent the storage of credentials. However, builds started before the plugin was updated to 1.40.0 may still retain the encoded credentials on disk.
How To Fix
Latest published version: 1.42.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.40.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability.
Conclusion
The Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older is vulnerable to a local file system access issue that allows an attacker to obtain GitHub credentials. To mitigate this vulnerability, it is crucial to revoke old GitHub credentials used in Jenkins and update the plugin to version 1.40.0 or newer. Following the recommended steps will help protect against unauthorized access to GitHub repositories and sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:ghprb →
FAQ
This vulnerability allows an attacker with local file system access to obtain GitHub credentials, potentially leading to unauthorized access to GitHub repositories and sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide the URL of your Jenkins instance and the playground will analyze your pom.xml file to identify any vulnerable dependencies.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the recommended fixes and keep the Jenkins GitHub Pull Request Builder Plugin up to date to mitigate the risk.
Yes, a script is provided for use in the Script Console that attempts to remove old stored credentials from build.xml files. You can find the script in the official Jenkins documentation or seek assistance from the Jenkins community.
Yes, there are alternative plugins available for integrating Jenkins with GitHub pull requests. Some popular options include the 'GitHub Branch Source Plugin' and the 'GitHub Integration Plugin'. It is recommended to evaluate these alternatives and choose the one that best fits your requirements.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:ghprb.
