CVE-2019-10286: Jenkins DeployHub Plugin stores credentials in plain text
Summary
CVE-2019-10286: Jenkins DeployHub Plugin stores credentials in plain text. Affects com.openmake:deployhub versions < 8.0.14. Fixed in 8.0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins DeployHub Plugin is a Maven package (com.openmake:deployhub) that is used in Jenkins to manage deployment processes. It provides functionality for storing and managing credentials used in job configurations. However, a vulnerability has been identified in this plugin that allows credentials to be stored in plain text in the job config.xml files on the Jenkins controller. This means that anyone with Extended Read permission or access to the Jenkins controller file system can view these credentials.
Vulnerability Detail
The vulnerability in the Jenkins DeployHub Plugin allows sensitive credentials to be stored in plain text, which can be accessed by unauthorized users. This can lead to potential security breaches and unauthorized access to sensitive systems or data. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-522.
How To Fix
Latest published version: 8.0.14 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the Jenkins DeployHub Plugin to the latest version.
Conclusion
The Jenkins DeployHub Plugin vulnerability (CVE-2019-10286) allows credentials to be stored in plain text, potentially leading to unauthorized access and security breaches. To mitigate this vulnerability, it is crucial to update the plugin to version 8.0.14 or later. Regularly reviewing and rotating credentials, as well as following security best practices, can further enhance the security of Jenkins deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.openmake:deployhub →
FAQ
This vulnerability allows unauthorized users to view sensitive credentials stored in plain text. This can lead to potential security breaches and unauthorized access to systems or data.
Users of the Jenkins DeployHub Plugin versions prior to 8.0.14 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to update the plugin to the latest version to mitigate the risk.
In addition to updating the Jenkins DeployHub Plugin, it is recommended to follow security best practices such as limiting access to the Jenkins controller file system and regularly reviewing and rotating credentials.
Related vulnerabilities
Recent vulnerabilities recorded for com.openmake:deployhub.
