CVE-2020-2182: Improper masking of secrets in Jenkins Credentials Binding Plugin
Summary
CVE-2020-2182: Improper masking of some secrets in Jenkins Credentials Binding Plugin. Affects org.jenkins-ci.plugins:credentials-binding versions < 1.23. Fixed in 1.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Credentials Binding Plugin is a tool that allows users to specify passwords and other secrets as environment variables in Jenkins builds. It provides a way to hide these secrets from console output during the build process. However, a vulnerability was discovered in versions 1.22 and earlier of the plugin, where the escaped form of secrets containing $$ was not properly masked. This vulnerability can be exploited in the 'Execute Maven top-level targets' build step included in Jenkins.
Vulnerability Detail
The vulnerability (CVE-2020-2182) in the Jenkins Credentials Binding Plugin allows an attacker to view secrets that are supposed to be masked. When secrets containing $$ are passed to (post) build steps, the escaped form of the secret is not properly masked. This means that an attacker with access to the console output of a build can potentially extract sensitive information. The vulnerability has a CVSS score of 3.1, indicating a low severity level.
How To Fix
Latest published version: 728.v902a_273b_8947 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.23
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of the Credentials Binding Plugin.
Conclusion
The Jenkins Credentials Binding Plugin has a vulnerability (CVE-2020-2182) that allows secrets to be improperly masked, potentially exposing sensitive information. Upgrading to version 1.23 or later of the plugin will fix this vulnerability. It is recommended to check if your application is affected using the Vulert Playground (https://vulert.com/scanner) and upgrade to the latest version of the plugin to ensure security.
See every vulnerability recorded for org.jenkins-ci.plugins:credentials-binding →
FAQ
The impact of this vulnerability is that an attacker with access to the console output of a build can potentially extract sensitive information, such as passwords and other secrets.
Versions 1.22 and earlier of the Credentials Binding Plugin are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
There is no known exploit for this vulnerability at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:credentials-binding.
