CVE-2026-48922: Jenkins Credentials Binding Plugin Path Traversal Vulnerability
Summary
CVE-2026-48922: Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials. Affects org.jenkins-ci.plugins:credentials-binding versions < 725.ve52b. Fixed in 725.ve52b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Credentials Binding Plugin is a widely used tool within the Jenkins CI/CD ecosystem that allows users to manage and bind credentials to jobs securely. It supports various types of credentials, including file and zip file credentials, enabling seamless integration into build processes. However, this plugin has a critical vulnerability that arises from improper sanitization of file names, potentially exposing systems to serious security risks.
Vulnerability Detail
The vulnerability in the Jenkins Credentials Binding Plugin, identified as CVE-2026-48922, stems from its failure to properly sanitize file names for file and zip file credentials. This oversight allows attackers with the ability to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to permit low-privileged users to configure these credentials, it may lead to remote code execution, posing a significant threat to the integrity and security of the system.
How To Fix
Latest published version: 728.v902a_273b_8947 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
725.ve52b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the ability of low-privileged users to configure file or zip file credentials in Jenkins. This can help mitigate the risk of exploitation until the plugin is updated to a secure version.
Conclusion
The Jenkins Credentials Binding Plugin has a critical vulnerability (CVE-2026-48922) that can lead to severe security risks if not addressed. Users are advised to update to the latest version to ensure proper sanitization of file names and mitigate the risk of exploitation. Utilizing tools like Vulert can further enhance security monitoring.
See every vulnerability recorded for org.jenkins-ci.plugins:credentials-binding →
FAQ
CVE-2026-48922 is a vulnerability in the Jenkins Credentials Binding Plugin that allows attackers to exploit improper file name sanitization, potentially leading to remote code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow unauthorized users to write files to arbitrary locations on the filesystem, leading to potential remote code execution and compromising system security.
You can update the plugin by modifying your Maven project's pom.xml file to include the patched version 725.ve52b as shown in the 'how_to_fix' section.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the pom.xml file. It helps developers stay informed about potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:credentials-binding.
