CVE-2020-2182 Improper masking of some secrets in Jenkins Credentials Binding Plugin

What is CVE-2020-2182?

CVE-2020-2182 is a medium-severity vulnerability in Jenkins Credentials Binding Plugin, published on 6 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances.

Weakness: CWE-522

Which versions are affected by CVE-2020-2182?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:credentials-binding. It affects 1 product.

Products include Jenkins Credentials Binding.

How do I fix CVE-2020-2182?

Upgrade org.jenkins-ci.plugins:credentials-binding to 1.23 or later.

Is CVE-2020-2182 being exploited?

There is no known exploitation of CVE-2020-2182 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Credentials Binding Plugin

• CVE-2026-48922 Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials High 7.5
• CVE-2026-42520 Jenkins Credentials Binding Plugin has a path traversal vulnerability High 7.5
• CVE-2025-53650 Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages High 7.3
• CVE-2020-2181 Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps Medium 6.5
• CVE-2019-1010241 Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7ff8-qfwx-8gx5.