This vulnerability permits credentials submitted via POST config.xml to be stored unencrypted in job configuration files on the Jenkins controller. Those files can be accessed by users with Item/Extended Read rights or by anyone who can read the Jenkins controller filesystem, allowing them to view sensitive information. The weakness is a classic case of storing secrets in plaintext (CWE-311) and lack of encryption of credentials (CWE-312).

All Jenkins Project Jenkins releases up to version 2.567, and Long-Term Support releases up to 2.555.2, are affected. Any job configuration files generated by these versions may contain unencrypted credentials. Administrators should review deployments running within these version ranges to assess exposure.

The CVSS score is 5.3, and the EPSS score is less than 1%, indicating very low but nonzero exploitation probability. The vulnerability can be exploited by any actor who possesses Item/Extended Read permission or who can read the Jenkins controller filesystem. The attack vector is inferred to be internal to the Jenkins environment, either local or remote, depending on network exposure. Given the potential for credential theft, the risk is significant and warrants immediate attention. The vulnerability is not listed in CISA’s KEV catalogue.