Jenkins Eggplant Runner Plugin: clears a JVM-wide proxy protection, exposing Basic credentials over HTTPS tunnels

Impact

The plugin sets the Java system property jdk.http.auth.tunneling.disabledSchemes to an empty value, which re-enables Basic authentication for HTTPS CONNECT tunnels. A system property is process-wide: installing this plugin weakens the protection for every outbound HTTPS-through-proxy request made by the whole Jenkins controller JVM, not just the plugin's own calls. On a build controller that holds registry, cloud and cluster credentials, that turns a proxy - or anything positioned to act as one - into a place where Basic credentials can be captured in cleartext. Confidentiality only; builds continue to run.

Who can reach it

An attacker who controls or can impersonate the HTTP proxy the Jenkins controller tunnels through, or who sits on that path, and who can observe a request that carries Basic credentials. No Jenkins authentication is needed, but the proxy position is.

What to do

No fixed version is listed in the record - the advisory covers 0.0.1.301.v963cffe8ddb_8 and earlier. Check the Jenkins security advisory for 2025-10-29 before planning an upgrade; in the meantime the mitigation is to uninstall the plugin and restart the controller, or to pin jdk.http.auth.tunneling.disabledSchemes back to a safe value in the controller's JVM arguments so the plugin's assignment does not stand. Rotate any credentials that may have crossed an untrusted proxy.

References

Related entries

• ansible-runner: streamed archive extraction follows symlinks and writes outside the target directoryCVE-2026-103754 · ansible-runner (unstream_dir() in the transmit/worker protocol)Medium
• GitLab: improper redirect validation in the Kubernetes proxy sends cluster auth tokens to an attacker-chosen serverCVE-2026-7767 · GitLab CE/EE (Kubernetes agent proxy redirect validation)Medium
• DMTF libspdm - SPDM Requester timeout handling: A libspdm Requester stores the Responder's CTExponentCVE-2023-32690 · DMTF libspdm - SPDM Requester timeout handlingMedium
• Dell OpenManage Enterprise (path traversal): An unauthenticated remote attacker reads files from the OME serverCVE-2024-25944 · Dell OpenManage Enterprise (path traversal)Medium
• Elastic Metricbeat: oversized Prometheus remote_write request drives an unbounded allocation and kills the beatCVE-2026-26931 · Elastic Metricbeat (Prometheus remote_write HTTP handler)Medium
• AMD Zen 1 / Zen 2 / Zen 3 - execution unit scheduler queue contention (SMT): AMD's split scheduler design gives eachCVE-2021-46778 · AMD Zen 1 / Zen 2 / Zen 3 - execution unit scheduler queue contention (SMT)Medium