CVE-2019-10473: Jenkins Libvirt Slaves Plugin Vulnerable to Credential Enumeration
Summary
CVE-2019-10473: Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration. Affects org.jenkins-ci.plugins:libvirt-slave versions < 1.8.6. Fixed in 1.8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Libvirt Slaves Plugin is a Maven package that provides functionality for managing virtual machine slaves in a Jenkins environment. It allows users to create and manage virtual machines as build slaves for Jenkins jobs. The plugin integrates with the Libvirt API to interact with the virtualization capabilities of the underlying host system. This vulnerability specifically affects versions prior to 1.9.0 of the plugin.
Vulnerability Detail
A missing permission check in the Jenkins Libvirt Slaves Plugin allows users with Overall/Read access to enumerate the credentials ID of credentials stored in Jenkins. This means that unauthorized users with read access to Jenkins can gather information about the stored credentials, potentially leading to further attacks or unauthorized access to sensitive information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 325.ve30f881b_95c9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins Libvirt Slaves Plugin.
Conclusion
The Jenkins Libvirt Slaves Plugin prior to version 1.9.0 is vulnerable to credential enumeration, allowing unauthorized users with read access to Jenkins to gather information about stored credentials. To mitigate this vulnerability, it is recommended to upgrade to version 1.9.0 or later of the plugin. No known exploits for this vulnerability exist at the time of this report. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:libvirt-slave →
FAQ
The vulnerability allows unauthorized users with read access to Jenkins to gather information about stored credentials, potentially leading to further attacks or unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is still important to apply the recommended fix to prevent any potential unauthorized access or attacks.
No, the recommended fix for this vulnerability is to upgrade to the latest version of the Jenkins Libvirt Slaves Plugin. There are no known workarounds or alternative mitigation methods.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:libvirt-slave.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
