CVE-2026-84676

2th percentile - higher than 2% of all known CVEs

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Users with appropriate permissions can access sensitive tokens, potentially leading to unauthorized access to remote systems or security compromise.

Update Jenkins Parameterized Remote Trigger Plugin to a version that encrypts tokens, and restrict access to config.xml files and Item/Extended Read permissions.