Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Affected Packages

Maven org.jenkins-ci.plugins:rundeck

Affected versions: 0 (fixed in 3.6.6)

Related CVEs

CVE-2019-16556

Key Information

GHSA ID

GHSA-qh3m-c6hw-5hmv

Published

May 24, 2022 5:03 PM

Last Modified

January 30, 2024 9:14 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:rundeck

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.