CVE-2019-1003071: Jenkins Octopus Deploy Plugin stores credentials in plain text
Summary
CVE-2019-1003071: Jenkins Octopus Deploy Plugin stores credentials in plain text. Affects hudson.plugins.octopusdeploy:octopusdeploy versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Octopus Deploy Plugin is a Maven package that provides integration between Jenkins and Octopus Deploy, a deployment automation tool. It allows users to deploy applications and manage releases using Octopus Deploy from within Jenkins. The plugin is widely used in software development and deployment pipelines.
Vulnerability Detail
The plugin stores credentials in plain text in its global configuration file hudson.plugins.octopusdeploy.OctopusDeployPlugin.xml on the Jenkins controller. This means that anyone with access to the Jenkins controller file system can view these credentials. This vulnerability poses a risk of unauthorized access to sensitive information, such as API keys or passwords, which can lead to further security breaches or unauthorized deployments.
How To Fix
Latest published version: 4.1.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The Jenkins Octopus Deploy Plugin is vulnerable to storing credentials in plain text, which can lead to unauthorized access to sensitive information. Users should upgrade to version 1.9.0 or later of the plugin to fix this vulnerability. There are no known workarounds, and it is important to address this issue promptly to ensure the security of your Jenkins deployment. For further support, contact DevNack.com.
See every vulnerability recorded for hudson.plugins.octopusdeploy:octopusdeploy →
FAQ
This vulnerability allows unauthorized users with access to the Jenkins controller file system to view stored credentials in plain text. This can lead to unauthorized access to sensitive information and potential security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities in real-time.
There are no known exploits for this vulnerability at the moment. However, it is important to fix the vulnerability as soon as possible to prevent any potential unauthorized access to sensitive information.
No, manual encryption of the stored credentials is not recommended. It is best to upgrade to the fixed version of the plugin, which includes automatic encryption of the credentials.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for hudson.plugins.octopusdeploy:octopusdeploy.
