Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-53650 · ADVISORY
• jenkinsci/credentials-binding-plugin · PACKAGE
• jenkins.io/security/advisory/2025-07-09 · WEB
• openwall.com/lists/oss-security/2025/07/09/4 · WEB

More vulnerabilities in org.jenkins-ci.plugins:credentials-binding

• CVE-2026-48922HIGH 7.5Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, a…
• CVE-2026-42520HIGH 7.5Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing a…
• CVE-2022-20616MEDIUM 4.3Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing a…
• CVE-2020-2182MEDIUM 4.3Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some …
• CVE-2020-2181MEDIUM 6.5Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build con…