CVE-2020-2181: Jenkins Credentials Binding Plugin Secrets Disclosure
Summary
CVE-2020-2181: Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps. Affects org.jenkins-ci.plugins:credentials-binding versions < 1.23. Fixed in 1.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Credentials Binding Plugin is a Maven package that provides a secure way to manage and use credentials in Jenkins builds. It allows users to bind credentials to environment variables and files, ensuring sensitive information is protected. However, versions 1.22 and earlier of the plugin have a vulnerability that exposes secrets in the build log when the build contains no build steps. This can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability (CVE-2020-2181) in the Jenkins Credentials Binding Plugin allows secrets to be disclosed in the build log when there are no build steps. This means that if a build is configured without any build steps, any secrets bound using the plugin will be visible in plain text in the build log. This can be a serious security issue as it exposes sensitive information, such as passwords or API keys, to anyone with access to the build log. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 728.v902a_273b_8947 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.23
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately possible, a workaround is to ensure that every build includes at least one build step. This will trigger the masking of secrets in the build log. For example, a simple workaround can be adding a dummy build step that does nothing, such as an 'echo' command.
Conclusion
The Jenkins Credentials Binding Plugin versions 1.22 and earlier have a vulnerability that exposes secrets in the build log when there are no build steps. To mitigate this issue, users should upgrade to version 1.23 or later of the plugin. Alternatively, they can ensure that every build includes at least one build step. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:credentials-binding →
FAQ
The vulnerability allows secrets to be exposed in the build log, potentially leading to unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any known vulnerabilities.
Yes, a workaround is to ensure that every build includes at least one build step. This will mask secrets in the build log.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To update the plugin, follow the standard update process for Jenkins plugins. Go to the Jenkins dashboard, navigate to the 'Manage Jenkins' section, and select 'Manage Plugins'. From there, you can search for the Credentials Binding Plugin and update it to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:credentials-binding.
