CVE-2026-92130 Missing authorization in Jenkins Pipeline: Multibranch Plugin
Attackers with Item/Configure permission can access unauthorized credentials due to incorrect context in the resolveScm step.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92130?
CVE-2026-92130 is a low-severity missing authorization vulnerability in Jenkins Pipeline: Multibranch Plugin, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
Weakness: CWE-863
Which versions are affected by CVE-2026-92130?
How do I fix CVE-2026-92130?
No fix has been published for CVE-2026-92130 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92130 being exploited?
There is no known exploitation of CVE-2026-92130 in the wild and no public exploit code.
Sources
Also known as GHSA-hmmg-x486-7jhf.