4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48926

CVE-2026-48926: Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint

Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48926

CVE-2026-48926:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:job-import-plugin	maven	< 143.145.v48f9a	143.145.v48f9a

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-48926, allows for the enumeration of credential IDs in Jenkins Job Import Plugin. By analyzing the commits between the last vulnerable version and the first patched version, I identified the security fix in commit 4ff3d5da367aaaddf114375b6c295a4335b4745f. The patch adds a permission check to the doFillDefaultCredentialsIdItems method in src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java. In Jenkins, methods with names starting with doFill are typically exposed over HTTP to populate UI elements. The lack of a permission check in this method allowed unauthorized users to access it and enumerate credential IDs. Therefore, org.jenkins.ci.plugins.jobimport.model.JenkinsSite$DescriptorImpl.doFillDefaultCredentialsIdItems is the vulnerable function.

Vulnerable functions

org.jenkins.ci.plugins.jobimport.model.JenkinsSite$DescriptorImpl.doFillDefaultCredentialsIdItems

src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java

The vulnerability lies in the `doFillDefaultCredentialsIdItems` method within the `JenkinsSite.java` file. Before the patch, this method did not perform any permission checks. This allowed any user with Overall/Read access to Jenkins to call this method via an HTTP endpoint and receive a list of all credential IDs stored in Jenkins. The patch mitigates this by adding a permission check to ensure that only users with `Job Import/Import Jobs` permission can execute this method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.