# org.jenkins-ci.plugins:credentials-binding (Maven) vulnerabilities

8 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 6
- Registry: https://central.sonatype.com/artifact/org.jenkins-ci.plugins/credentials-binding

## Advisories (8)

### [CVE-2026-48922](https://cve.now/CVE-2026-48922): Jenkins Credentials Binding Plugin 720.v3f6decef43ea\_ and earlier does not properly sanitize file names for file and zip file credentials…

- Severity: High 7.5
- Published: May 27, 2026
- Affected: fixed in 725.ve52b.

### [CVE-2026-42520](https://cve.now/CVE-2026-42520): Jenkins Credentials Binding Plugin 719.v80e905ef14eb\_ and earlier does not sanitize file names for file and zip file credentials, allowing…

- Severity: High 7.5
- Published: Apr 29, 2026
- Affected: fixed in 720.v3f6decef43ea.

### [CVE-2025-53650](https://cve.now/CVE-2025-53650): Jenkins Credentials Binding Plugin 687.v619cb\_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials…

- Severity: High 7.3
- Published: Jul 9, 2025
- Affected: fixed in 687.689.v1a.

### [CVE-2022-20616](https://cve.now/CVE-2022-20616): Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing…

- Severity: Unrated
- Published: Jan 12, 2022
- Affected: from 1.25, fixed in 1.27.1; fixed in 1.24.1.

### [CVE-2020-2182](https://cve.now/CVE-2020-2182): Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a \`$\` character in…

- Severity: Unrated
- Published: May 6, 2020
- Affected: fixed in 1.23.

### [CVE-2020-2181](https://cve.now/CVE-2020-2181): Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build…

- Severity: Unrated
- Published: May 6, 2020
- Affected: fixed in 1.23.

### [CVE-2019-1010241](https://cve.now/CVE-2019-1010241): Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format.

- Severity: Unrated
- Published: Jul 19, 2019
- Affected: versions 1.17.

### [CVE-2018-1000057](https://cve.now/CVE-2018-1000057): Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs.

- Severity: Unrated
- Published: Feb 9, 2018
- Affected: fixed in 1.15.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.jenkins-ci.plugins:credentials-binding
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.