CVE-2026-84674
published 2026-09-02CVE-2026-84674: Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.23%
13.7th percentile
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | allure | — | — |
| jenkins | allure_plugin | — | — |
| jenkins | build_step | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | customizable_header | — | — |
| jenkins | customizable_header_plugin | — | — |
| jenkins | databoundsetter_annotated_methods_that_manage_the | — | — |
| jenkins | databoundsetter_annotated_methods_that_manage_the_plugin | — | — |
| jenkins | file_parameter | — | — |
| jenkins | file_parameter_plugin | — | — |
| jenkins | gitlab | — | — |
| jenkins | gitlab_plugin | — | — |
| jenkins | groovy_libraries | — | — |
| jenkins | groovy_libraries_plugin | — | — |
| jenkins | ids_in_xebialabs_xl_deploy | — | — |
| jenkins | ids_in_xebialabs_xl_deploy_plugin | — | — |
| jenkins | improper_access_control_in_customizable_header | — | — |
| jenkins | improper_access_control_in_customizable_header_plugin | — | — |
| jenkins | improper_access_control_in_ldap | — | — |
| jenkins | improper_access_control_in_ldap_plugin | — | — |
| jenkins | improper_access_control_in_saml | — | — |
| jenkins | improper_access_control_in_saml_plugin | — | — |
| jenkins | improper_access_control_in_thinbackup | — | — |
| jenkins | improper_access_control_in_thinbackup_plugin | — | — |
| jenkins | jenkins_core | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
ghsa_unreviewed·2026-09-02
CVE-2026-84674 [MEDIUM] CWE-862 Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
VulDB
XebiaLabs XL Deploy Plugin up to 26.1.0 permission
vuldb·2026-09-02·CVSS 5.4
CVE-2026-84674 [MEDIUM] XebiaLabs XL Deploy Plugin up to 26.1.0 permission
A vulnerability was found in XebiaLabs XL Deploy Plugin up to 26.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. Such manipulation leads to permission issues.
This vulnerability is uniquely identified as CVE-2026-84674. The attack can be launched remotely. No exploit exists.
Jenkins
Jenkins Security Advisory 2026-09-02
vendor_jenkins·2026-09-02·CVSS 8.8
CVE-2026-84645 [HIGH] Jenkins Security Advisory 2026-09-02
Title: Jenkins Security Advisory 2026-09-02
Jenkins Security Advisory 2026-09-02
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Allure
Plugin
Customizable Header
Plugin
File Parameter
Plugin
GitLab
Plugin
Job Configuration History
Plugin
LDAP
Plugin
Microsoft Entra ID (previ
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-02
Published