CVE-2026-92133: Jenkins GitLab Plugin vulnerability
Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins GitLab Pluginto a version that resolves this vulnerability.Fixed in 1.2149.vcfc32c82b_f7f - Compensating control
Restrict Item/Configure permission in Jenkins so that users cannot modify job configuration to trigger access to cached GitLab API token credentials they are not entitled to use.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Item/Configure permission. They can exploit the issue to access GitLab API token credentials resolved in a different folder, even when they are not otherwise entitled to use those credentials.
Which deployments are affected?
Jenkins installations using GitLab Plugin version 1.2149.vcfc32c82b_f7f or earlier are affected. The issue specifically concerns alternative GitLab API token credentials and folder-based credential resolution.
How can I tell whether my Jenkins instance is exposed?
Check the installed Jenkins GitLab Plugin version and whether users with Item/Configure permission can configure items in folders. Exposure is relevant where alternative GitLab API token credentials are available through folder-scoped credential resolution.