CVE-2026-92133
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.
Risk Assessment
An attacker with Item/Configure permission can access GitLab API token credentials they should not have access to, potentially leading to unauthorized operations in GitLab.
Recommendation
Update Jenkins GitLab Plugin to a version newer than 1.2149.vcfc32c82b_f7f, which includes the folder in the cache key.
Other vulnerabilities in Jenkins GitLab Plugin
Original NVD description (English source)
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab API token credentials they are not entitled to use.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS