Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.cloudbees.jenkins.plugins:kubernetes-credentials-provider

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    Exposure of system-scoped Kubernetes credentials in Jenkins Kubernetes Credentials Provider Plugin

    CVE-2023-24425 · GHSA-2jpx-h8j2-g8m4

    Affected
    • Maven com.cloudbees.jenkins.plugins:kubernetes-credentials-provider < 1.209.v862c6e5fb
    Fixed in
    1.209.v862c6e5fb· Vendor fix available
    Issue
    Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.

    Recommended action: Upgrade to 1.209.v862c6e5fb or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →