CVE-2026-92130

Executive Summary

CVE-2026-92130 is an improper authorization vulnerability in the Jenkins Pipeline: Multibranch Plugin (versions 841.vec5b_9e1806ec and earlier) that causes the resolveScm Pipeline step to perform credential lookups in an incorrect context. An attacker holding only Item/Configure permission can thereby cause the step to resolve and expose credentials to which they are not entitled, resulting in the capture of secrets (confidentiality impact). Exploitation requires a relatively high degree of pre-existing access (authenticated, low privilege, network reachable) and elevated attack complexity, yielding a CVSS v3.1 base score of 3.1; no public PoC, exploit code, or CISA KEV entry exists as of this writing, and the vulnerability is currently unpatched.

Technical Analysis

The Jenkins Pipeline: Multibranch Plugin provides the resolveScm Pipeline step, which resolves the SCM configuration for a multibranch project and is frequently used to inject credentials (for example, an SCM checkout credential) into a Pipeline run. Jenkins isolates credentials using a context model: credential lookups are scoped to a specific "context" (typically tied to the item, folder, or a specific authentication/authorization boundary) to prevent a user in one project from resolving credentials belonging to another, or credentials they are not permitted to bind.

Per the NVD description, versions 841.vec5b_9e1806ec and earlier "does not set the appropriate context for credentials lookup in the resolveScm Pipeline step." As a result of this missing/inadequate context assignment, resolveScm does not restrict the credential lookup to the caller's entitled scope. A user possessing Item/Configure permission on the relevant item can therefore trigger resolution of credentials that fall outside their authorization boundary and "access and capture credentials they are not entitled to."

The root cause class is CWE-863 (Incorrect Authorization). The defect is an authorization-scoping/credential-binding flaw, not a memory-safety, injection, or deserialization issue. No specific function names, identifiers, or code paths beyond the resolveScm step name and the plugin name are disclosed in the source data; therefore no code-level reconstruction should be attempted. The relevant attack surface is the Jenkins Pipeline definition mechanism for multibranch projects: any actor able to author or modify Pipeline configuration for an item can invoke Pipeline steps, and the resolveScm step's credential handling is the exact point of failure. Because resolveScm is core to how multibranch Pipelines acquire SCM credentials, the step is broadly present on Jenkins controllers with the Multibranch plugin installed — widening the pool of potential targets even though exploitation itself demands specific permissions and timing.

Attack complexity is rated High (AC:H) because the attacker must be positioned with the required Jenkins authorization and must induce credential resolution through the step under the conditions the bug exposes — this is not a single unauthenticated request. Privileges Required is Low (PR:L), reflecting that only Item/Configure is needed rather than full administrative rights. User Interaction is None (UI:N), meaning the victim need not click or approve anything; the flaw is triggered server-side by the attacker's Pipeline actions. Scope is Unchanged (S:U) — the vulnerable component and impacted credential store remain within the Jenkins authorization boundary — and only Confidentiality is affected (C:L), consistent with a credential-disclosure impact rather than code execution or data destruction.

Exploitation Scenarios

No public PoC or exploit code is available; the following chain is inferred at the vulnerability-class level from the NVD description and must not be read as a confirmed implementation-specific recipe.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Jenkins controller with the Pipeline: Multibranch Plugin installed at version 841.vec5b_9e1806ec or earlier. Fingerprinting can be performed passively (HTTP response headers and the Jenkins dashboard title) and does not require any interaction with the vulnerable step. The attacker must confirm they can authenticate and hold at least Item/Configure permission on a multibranch item — this is the reconnaissance constraint that gates the attack.

2. Triggering the flaw class. With Item/Configure authorization, the attacker uses their ability to author or modify Pipeline configuration for the multibranch item so that the resolveScm Pipeline step is invoked. Because the plugin fails to set the appropriate credentials-lookup context for that step, the step resolves credentials outside the attacker's entitled scope. The incorrect authorization scoping is the triggered flaw; the attacker does not need to exploit any injection primitive, only to exercise a legitimate Pipeline step that mishandles context.

3. Payload / execution method (class-level). The "payload" is the Pipeline configuration that causes resolveScm to run and resolve credentials into the build. Execution occurs as part of the Pipeline run on the Jenkins controller. The attacker then captures the resolved credential material — for example, by observing it in the build result, logs, output, or by directing it into a step they control. No fabricated parameter or endpoint names are asserted here; the mechanism is credential disclosure via an improperly scoped resolveScm lookup.

4. Post-exploitation impact. The captured credentials may grant access to source-control systems, artifact repositories, or other services for which the attacker was never authorized. The direct, described impact is credential confidentiality loss (C:L). Because these secrets frequently authorize downstream systems, successful capture can be used to pivot into adjacent infrastructure, clone private repositories, or tamper with build inputs — though such downstream effects depend on the privileges of the disclosed credentials and are not themselves asserted by the CVE.

The attack requires no user interaction (UI:N) and no victim cooperation beyond the normal execution of the Pipeline run the attacker configures.

Impact Assessment

• Confidentiality (Low): the disclosed impact is unauthorized access to and capture of credentials. The CVSS C:L subscore reflects a bounded but real disclosure effect rather than mass exfiltration.
• Integrity (None): the vulnerability as described does not modify data.
• Availability (None): no denial-of-service component is described.
• Blast radius: any Jenkins controller running the affected Multibranch plugin version where at least one user holds Item/Configure permission on a multibranch item. In shared or multi-tenant Jenkins instances — common in enterprises where teams self-manage their own folders/items — the pool of Item/Configure holders is often large, materially increasing exposure.
• Business impact: leakage of SCM and pipeline credentials is high-value to an attacker. Depending on what those credentials protect, consequences can include unauthorized access to private source code, build-time secrets, artifact repositories, and adjacent systems — turning a low-CVSS authorization bug into a meaningful supply-chain or lateral-movement enabler.
• Environment note: CVSS 3.1 base score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). This low base reflects the High attack complexity and Low confidentiality impact; it should not be interpreted as low operational risk in environments where Jenkins credentials grant broad downstream privilege.

Detection Guidance

Detection must focus on anomalous use of the resolveScm step, unexpected Pipeline modifications by Item/Configure holders, and outbound access using Jenkins-held credentials. The rules below are representative starting points and require tuning to each environment's Pipeline and identity baselines. They target the described behavior (unauthorized credential resolution via resolveScm) and do not assume undocumented internals.

Sigma Rule

title: Jenkins resolveScm Credential Context Abuse (CVE-2026-92130)
id: 7a3f1c2e-9213-40b5-9e10-000000092130
status: experimental
description: Detects Jenkins Pipeline Multibranch resolveScm step invocations that may resolve credentials outside the caller's entitled context (CWE-863).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92130
author: valtersit.com
date: 2026/01/01
logsource:
  product: jenkins
  service: pipeline
detection:
  selection_step:
    message|contains: 'resolveScm'
  selection_cred:
    message|contains:
      - 'credentials'
      - 'Credential'
      - 'resolveScm'
  selection_context:
    message|contains:
      - 'context'
      - 'Multibranch'
  condition: selection_step and (selection_cred or selection_context)
falsepositives:
  - Legitimate multibranch Pipeline runs that invoke resolveScm with properly scoped credentials.
  - Administrative configuration changes.
level: medium
tags:
  - attack.t1078
  - cve.2026.92130

YARA Rule

rule CVE_2026_92130_Jenkins_resolveScm_Context
{
    meta:
        description = "Detects artifacts referencing the Jenkins resolveScm step associated with CVE-2026-92130 credential context misconfiguration"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92130"
        date = "2026-01-01"
        cve = "CVE-2026-92130"
    strings:
        $step   = "resolveScm" ascii wide
        $plugin = "Pipeline: Multibranch" ascii wide
        $scm    = "resolveScm(" ascii wide
    condition:
        $step and ($plugin or $scm)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92130 Jenkins resolveScm credential context abuse attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/job/"; http.uri; content:"configSubmit"; content:"resolveScm"; nocase; classtype:attempted-user; reference:cve,CVE-2026-92130; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92130; sid:202692130; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [process where event.category == "process" and process.name in ("java") and process.args : "*resolveScm*"]
  [network where destination.port in (22, 443, 9418) and event.action == "connection_attempt"]

Splunk SPL Query

index=jenkins sourcetype=jenkins:pipeline OR sourcetype=jenkins:build
| search "resolveScm" (credentials OR credential OR context)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(user) as users values(job_name) as jobs by src_ip, host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="jenkins,cve-2026-92130,">
  <rule id="921300" level="8">
    <decoded_as>json</decoded_as>
    <field name="message">resolveScm</field>
    <description>CVE-2026-92130: Jenkins resolveScm step invoked - potential credential context abuse (CWE-863).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>jenkins_credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the provided intelligence. Treat all guidance below as compensating controls until an official fix is published by the Jenkins project.

1. Immediate mitigations

• Restrict Item/Configure permission to the smallest possible set of trusted users and groups. Because the flaw is triggered by an authorized Item/Configure holder, shrinking that population directly removes the required precondition.
• Enforce least privilege in the Jenkins authorization strategy; audit and prune the Item/Configure grants across all folders and items.
• Where feasible, disable or avoid the resolveScm step on untrusted multibranch items, or restrict who can author/modify Pipeline configuration.
• Apply role-based or project-based matrix authorization and isolate high-value credentials in dedicated folders with tighter permissions.
• Network-restrict the Jenkins controller (no direct internet exposure); place it behind authentication-aware reverse proxy or VPN.

2. Patch / upgrade steps

• Monitor the Jenkins security advisories and update the Pipeline: Multibranch Plugin as soon as the Jenkins project releases a fixed version. No fixed version identifier is available in the current data — do not assume one.
• Once a patch is announced, verify the plugin version in Manage Jenkins → Plugins and upgrade immediately.
• Because no patch exists today, keep the plugin inventory current so remediation can be applied within hours of release.

3. Long-term hardening

• Rotate any credentials that were bindable by the affected multibranch items as a precaution, and review SCM/credential access logs for unauthorized clone or fetch activity.
• Adopt the principle that Pipeline authors should not hold Item/Configure on items whose credentials they are not entitled to resolve.
• Establish continuous plugin vulnerability scanning and a rapid patch SLAs for the Jenkins controller and all plugins.
• Enable comprehensive audit logging on the controller and forward to a SIEM (see Detection Guidance).
• Reassess credential scoping architecture so credential lookups are always bound to the correct item/folder/user context.

References

1. NVD — CVE-2026-92130: https://nvd.nist.gov/vuln/detail/CVE-2026-92130
2. MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
3. Jenkins Security Advisories (monitor for the fix release): https://www.jenkins.io/security/advisories/
4. Jenkins Pipeline: Multibranch Plugin documentation: https://plugins.jenkins.io/workflow-multibranch/
5. FIRST EPSS: No EPSS score is currently published for this CVE — do not assume a value.

Threat actor / exploit-in-the-wild status: No public PoC, no exploit code, no Nuclei template, and no CISA KEV entry are associated with CVE-2026-92130 in the provided intelligence. No known threat actor campaign is attributed. Exploitation remains theoretically possible for an authenticated low-privilege actor holding Item/Configure, but there is no evidence of active exploitation at this time.