CVE-2026-48922: Jenkins Credentials Binding Plugin 720

Synopsis

An arbitrary file write vulnerability exists in the Jenkins Credentials Binding Plugin version 720.v3f6decef43ea_ and earlier. The flaw is reachable over the network by an authenticated low-privilege user who can supply credentials to a Jenkins job, and no victim interaction is required to trigger it. Successful exploitation allows an attacker to write files to arbitrary locations on the node filesystem, which enables remote code execution when the affected job runs on the built-in node. No upstream fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Jenkins instance across the network to deliver the malicious credential payload.

• AuthenticationRequired

  Any low-privilege account that has permission to configure credentials for a Jenkins job is sufficient; no administrative access is needed.

• Victim interactionNot required

  No user interaction is required; the attacker triggers the write by supplying the crafted credential directly to the job configuration.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for specific environmental conditions, such as the Jenkins instance being configured to allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node.

Blast Radius

• Attacker writes arbitrary files to any path on the Jenkins node filesystem, overwriting existing files including scripts, configs, or binaries.
• If the written file lands in a location executed by Jenkins (such as a build script or plugin directory), the attacker achieves remote code execution on the built-in node.
• Full confidentiality, integrity, and availability of the Jenkins node are at risk: secrets stored on disk can be read, pipeline logic can be altered, and the node can be rendered inoperable.
• Compromise of the built-in Jenkins node can expose all credentials, pipeline definitions, and build artifacts accessible to that node.