CVE-2021-21648: Cross-Site Request Forgery in Jenkins Credentials Plugin
Summary
CVE-2021-21648: Cross-Site Request Forgery in Jenkins Credentials Plugin. Affects org.jenkins-ci.plugins:credentials across 6 version ranges.
< 2.3.0.1
>= 2.3.1, < 2.3.7.1
>= 2.3.8, < 2.3.13.1
>= 2.3.14, < 2.3.14.1
>= 2.3.15, < 2.3.15.1
>= 2.3.16, < 2.3.19
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Credentials Plugin is a Maven package that provides functionality for managing credentials within the Jenkins automation server. It allows users to securely store and use credentials such as usernames, passwords, and API tokens. This plugin is widely used in Jenkins installations to enable secure authentication and authorization for various tasks and workflows.
Vulnerability Detail
The Jenkins Credentials Plugin prior to versions 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This vulnerability occurs due to the plugin's failure to properly escape user-controlled information on a specific view it provides. As a result, an attacker can craft a malicious request that, when executed by an authenticated user, can lead to unauthorized actions being performed on behalf of the user. This vulnerability can be exploited to perform actions such as modifying or deleting credentials, potentially compromising the security of the Jenkins installation.
How To Fix
Latest published version: 1514.vb_01eb_014e7d4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.0.12.3.0.1 -
>= 2.3.1, < 2.3.7.12.3.7.1 -
>= 2.3.8, < 2.3.13.12.3.13.1 -
>= 2.3.14, < 2.3.14.12.3.14.1 -
>= 2.3.15, < 2.3.15.12.3.15.1 -
>= 2.3.16, < 2.3.192.3.19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading the Jenkins Credentials Plugin to the patched versions.
Conclusion
The Jenkins Credentials Plugin prior to versions 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This vulnerability can be mitigated by upgrading to the recommended patched versions. It is important to promptly apply the fix to protect the security of your Jenkins installation and the credentials stored within. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:credentials →
FAQ
This vulnerability allows an attacker to perform unauthorized actions on behalf of authenticated users, potentially compromising the security of the Jenkins installation and the credentials stored within.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix as soon as possible to mitigate the risk.
Yes, this vulnerability can be exploited remotely by an attacker who can trick an authenticated user into visiting a malicious website or clicking on a specially crafted link.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is advisable to apply the recommended fix to ensure the security of your Jenkins installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:credentials.
