CVE-2026-92130

The Jenkins Pipeline: Multibranch Plugin, up to and including version 841.vec5b_9e1806ec, does not set the appropriate context when looking up credentials for the resolveScm Pipeline step, an incorrect-authorization flaw (CWE-863). An attacker who holds Item/Configure permission on a Jenkins item can trigger resolveScm and capture credentials that they are not entitled to access. Because the flaw requires an authenticated user with job-configuration rights, the impact is limited to confidentiality (CVSS 3.1 of 3.1, low), but captured credentials could enable further access to SCM systems or other integrated services. All Jenkins controllers running the plugin at or below the affected version are exposed. No public proof-of-concept or known in-the-wild exploitation has been reported; a patch was issued as part of the Jenkins plugin security release cycle.

What to do: Update the Pipeline: Multibranch Plugin to a release newer than 841.vec5b_9e1806ec via the Jenkins plugin manager, following the fixed version listed in the Jenkins security advisory. In the meantime, restrict Item/Configure permission to trusted users and review job configurations and credential bindings for unexpected use of the resolveScm step. Audit which credentials are available to multibranch jobs and rotate any that may have been accessible to lower-privileged users.