Is CVE-2026-84676 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84676?

CVE-2026-84676 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-84676

Description

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.