CVE-2026-92133

5.4 Moyenne

Publiée le 16/09/2026 à 16:17 · Modifiée le 18/09/2026 à 15:46 · En attente d'analyse NVD · Source : jenkinsci-cert@googlegroups.com

Description

Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.

Traduire en français

Produits concernés

Jenkins Project Jenkins GitLab Plugin

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-522

Références

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3851

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories