Jenkins Parameterized Remote Trigger plugin: remote trigger tokens stored unencrypted in job config.xml

Impact

The plugin writes the tokens it uses to trigger jobs on remote Jenkins instances into job config.xml in cleartext on the controller filesystem. Anyone with Item/Extended Read on the job, or any read access to the controller's filesystem or its config backups, recovers a working credential for a different Jenkins instance. That is the awkward part on a fleet: the token is not scoped to the controller you compromised, it is the key to a second controller, so a low-privileged read on one CI system becomes job-triggering on another. Affects Parameterized Remote Trigger plugin 3.2.2 and earlier.

Who can reach it

An authenticated Jenkins user with Item/Extended Read on a job that uses the plugin, or anyone who can read the controller's filesystem or its config.xml backups. No administrative rights needed.

What to do

Upgrade the plugin past 3.2.2 per SECURITY-3800 in the 2026-09-02 Jenkins advisory - the advisory names 3.2.2 and earlier as affected without stating a fixed release, so take the current plugin version. Cost is a controller restart to load the plugin. Upgrading does not clean up what is already on disk: rotate every remote trigger token stored in an existing job, since the cleartext copies persist in config.xml history and in any backup taken before the upgrade. If the plugin is not actually in use, uninstalling it is the cheaper move.

References

Related entries

• GitLab CE/EE: developer-role user can modify package registry metadata without maintainer rightsCVE-2026-8667 · GitLab CE/EE (package registry metadata authorization)Medium
• Infineon cryptographic library (ECDSA) in security microcontrollers: Electromagnetic side channel in Infineon's ECDSACVE-2024-45678 · Infineon cryptographic library (ECDSA) in security microcontrollersMedium
• Slurm (slurmdbd accounting, Coordinator role): A Coordinator - the delegated role a site gives a team lead over theirCVE-2025-43904 · Slurm (slurmdbd accounting, Coordinator role)Medium
• HTCondor (condor_schedd / Access Point): A user plants a specially crafted job that lies dormant, then runs as aCVE-2025-66433 · HTCondor (condor_schedd / Access Point)Medium
• Jenkins core: build CLI -s flag cancels other users' builds without the Item/Cancel permissionCVE-2026-84657 · Jenkins core (build CLI command, -s flag skips Item/Cancel check)Medium
• AMD IOMMU register interface - ASP coherency: Improper access control on the IOMMU register interface lets a privilegedCVE-2025-54509 · AMD IOMMU register interface - ASP coherencyMedium