CVE-2026-84674: Jenkins Jenkins XebiaLabs XL Deploy Plugin vulnerability
Published Sep 2, 2026
·Updated
Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected Software
1 affected component
Jenkins Jenkins XebiaLabs XL Deploy Plugin<=26.1.0
Event History
Sep 2, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Any attacker or authenticated Jenkins user granted Overall/Read permission can enumerate the IDs of credentials stored in Jenkins.
2
Does exploitation require access to credential values?
No. The issue allows enumeration of credential IDs; the provided information does not state that credential secrets or values can be retrieved.
3
Which plugin versions are affected?
Jenkins XebiaLabs XL Deploy Plugin version 26.1.0 and earlier are affected.