Vulnerability record · CVE-2019-1010241 · published 19 July 2019

CVE-2019-1010241: Jenkins credentials binding insufficiently protected credentials vulnerability

Jenkins · Credentials Binding

Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.

6.5 CVSS 3.1 Medium EPSS 1.5% · top 27.3% CWE-257 · CWE-257CWE-522 · Insufficiently protected credentials

6.5CVSS 3.1 base score, v2 4.0

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Credentials Binding Jenkins

References

Link	Tags
http://www.securityfocus.com/bid/109320	Third Party AdvisoryVDB Entry
https://docs.google.com/document/d/1MBEoJSMvkjp5Kua0bRD_kiDBisL0fOCwTL9uMWj4lGA/edit?usp=sharing	ExploitThird Party Advisory
http://www.securityfocus.com/bid/109320	Third Party AdvisoryVDB Entry
https://docs.google.com/document/d/1MBEoJSMvkjp5Kua0bRD_kiDBisL0fOCwTL9uMWj4lGA/edit?usp=sharing	ExploitThird Party Advisory

Track CVE-2019-1010241 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-48922Jenkins credentials binding improper input validation vulnerabilityJenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing a…EPSS 0.58%27 May 2026 7.5CVE-2026-42520Jenkins credentials binding path traversal vulnerabilityJenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers …EPSS 0.60%29 Apr 2026 7.3CVE-2025-53650Jenkins credentials binding insufficiently protected credentials vulnerabilityJenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in except…EPSS 0.34%9 Jul 2025 6.5CVE-2020-2181Jenkins credentials binding insufficiently protected credentials vulnerabilityJenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no …EPSS 1.1%6 May 2020 4.3CVE-2022-20616Jenkins credentials binding missing authorization vulnerabilityJenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers …EPSS 0.85%12 Jan 2022 4.3CVE-2020-2182Jenkins credentials binding insufficiently protected credentials vulnerabilityJenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumsta…EPSS 0.88%6 May 2020 4.3CVE-2018-1000057Jenkins credentials binding insufficiently protected credentials vulnerabilityJenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms pr…EPSS 0.66%9 Feb 2018 7.5CVE-2026-20128Cisco Catalyst SD-WAN Manager DCA credential file exposureCisco Catalyst SD-WAN Manager stores the Data Collection Agent (DCA) user password in a recoverable credential file on the affected system. An unauth…KEVEPSS 7.8%analysed25 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2019-1010241), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.