Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build con

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• jenkins credentials bindingup to 1.22 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (jenkins). Independent of NVD's CPE analysis and usually ahead of it.

• Jenkins project Jenkins Credentials Binding Plugin

  • unspecified and later · up to and including 1.22affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-48922Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, a
  30Monitor
• CVE-2026-42520Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing a
  30Monitor
• CVE-2025-53650Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present
  29Monitor
• CVE-2019-1010241Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format.
  26Monitor
• CVE-2022-20616Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing a
  17Monitor
• CVE-2020-2182Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some
  17Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.