CVE-2023-30513: Jenkins Kubernetes Plugin Credential Masking Issue
Summary
CVE-2023-30513: Jenkins Kubernetes Plugin does not properly mask credentials. Affects org.csanchez.jenkins.plugins:kubernetes versions < 3910.ve59cec5e33ea. Fixed in 3910.ve59cec5e33ea. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Kubernetes Plugin is a plugin for the Jenkins automation server that allows users to dynamically provision Jenkins agents using Kubernetes. It integrates Jenkins with Kubernetes, enabling users to run Jenkins builds on Kubernetes clusters. The plugin provides features such as pod templates, container customization, and dynamic agent provisioning. However, the plugin is vulnerable to a credential masking issue that could expose sensitive information.
Vulnerability Detail
The Jenkins Kubernetes Plugin, along with other affected plugins, does not properly mask credentials printed in the build log from Pipeline steps like sh and bat. This vulnerability occurs when the credentials are printed in build steps executing on an agent and push mode for durable task logging is enabled. This can lead to the exposure of sensitive information, such as passwords or API keys, in the build log. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level. It could potentially be exploited by an attacker with access to the build log to obtain sensitive credentials.
How To Fix
Latest published version: 4560.vc25b_83890c34 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3910.ve59cec5e33ea
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Jenkins Kubernetes Plugin, along with other affected plugins, is vulnerable to a credential masking issue that could expose sensitive information in the build log. Users should update the affected plugins to the latest versions to fix this vulnerability. It is also recommended to regularly monitor for updates and apply them promptly to ensure the security of Jenkins deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.csanchez.jenkins.plugins:kubernetes →
FAQ
This vulnerability could potentially expose sensitive credentials, such as passwords or API keys, in the build log, allowing an attacker with access to the log to obtain this information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
As of now, there is no fix available for the Thycotic DevOps Secrets Vault plugin. Users are advised to monitor for updates and apply the fix as soon as it becomes available.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
There are no known exploits for this vulnerability at the moment. However, it is recommended to apply the fix as soon as possible to mitigate the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.csanchez.jenkins.plugins:kubernetes.
