CVE-2026-84676: Jenkins Parameterized Remote Trigger Plugin vulnerability
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed tokens?
Users with Item/Extended Read permission can view the tokens in job config.xml files. Anyone with access to the Jenkins controller file system can also view them.
What access does an attacker need to obtain a token?
An attacker needs either Item/Extended Read permission on affected jobs or access to the Jenkins controller file system where the job config.xml files are stored.
How can I determine whether tokens are exposed?
Check whether Jenkins Parameterized Remote Trigger Plugin version 3.2.2 or earlier is installed, then inspect affected job config.xml files for stored tokens. Review which users have Item/Extended Read permission and who can access the controller file system.