Jenkins Continuous Integration Engine
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Jenkins.
Recent Jenkins Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-04-29 | Jenkins Security Advisory 2026-04-29 | April 29, 2026 |
| 2026-03-18 | Jenkins Security Advisory 2026-03-18 | March 18, 2026 |
| 2026-02-18 | Jenkins Security Advisory 2026-02-18 | February 18, 2026 |
| 2025-12-10 | Jenkins Security Advisory 2025-12-10 | December 10, 2025 |
| 2025-10-29 | Jenkins Security Advisory 2025-10-29 | October 29, 2025 |
| 2025-09-17 | Jenkins Security Advisory 2025-09-17 | September 17, 2025 |
| 2025-09-03 | Jenkins Security Advisory 2025-09-03 | September 3, 2025 |
| 2025-07-09 | Jenkins Security Advisory 2025-07-09 | July 9, 2025 |
| 2025-06-06 | Jenkins Security Advisory 2025-06-06 | June 6, 2025 |
| 2025-05-14 | Jenkins Security Advisory 2025-05-14 | May 14, 2025 |
Known Exploited Jenkins Vulnerabilities
The following Jenkins vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Jenkins Remote Code Execution Vulnerability |
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. CVE-2017-1000353 Exploit Probability: 94.5% |
October 2, 2025 |
The vulnerability CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.
Jenkins EOL Dates
Ensure that you are using a supported version of Jenkins. Here are some end of life, and end of support dates for Jenkins.
| Release | EOL Date | Status |
|---|---|---|
| 2.541 | - |
Active
|
| 2.528 | January 21, 2026 |
EOL
Jenkins 2.528 became EOL in 2026. |
| 2.516 | October 15, 2025 |
EOL
Jenkins 2.516 became EOL in 2025. |
| 2.504 | July 23, 2025 |
EOL
Jenkins 2.504 became EOL in 2025. |
| 2.492 | April 30, 2025 |
EOL
Jenkins 2.492 became EOL in 2025. |
| 2.479 | February 5, 2025 |
EOL
Jenkins 2.479 became EOL in 2025. |
| 2.462 | October 2, 2024 |
EOL
Jenkins 2.462 became EOL in 2024. |
| 2.452 | August 7, 2024 |
EOL
Jenkins 2.452 became EOL in 2024. |
| 2.440 | May 15, 2024 |
EOL
Jenkins 2.440 became EOL in 2024. |
| 2.426 | February 21, 2024 |
EOL
Jenkins 2.426 became EOL in 2024. |
| 2.414 | November 15, 2023 |
EOL
Jenkins 2.414 became EOL in 2023. |
| 2.401 | August 23, 2023 |
EOL
Jenkins 2.401 became EOL in 2023. |
| 2.387 | May 31, 2023 |
EOL
Jenkins 2.387 became EOL in 2023. |
| 2.375 | March 8, 2023 |
EOL
Jenkins 2.375 became EOL in 2023. |
| 2.361 | November 30, 2022 |
EOL
Jenkins 2.361 became EOL in 2022. |
| 2.346 | September 7, 2022 |
EOL
Jenkins 2.346 became EOL in 2022. |
| 2 | - |
Active
|
By the Year
In 2026 there have been 13 vulnerabilities in Jenkins with an average score of 6.2 out of ten. Last year, in 2025 Jenkins had 75 security vulnerabilities published. Right now, Jenkins is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.73.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 13 | 6.24 |
| 2025 | 75 | 5.51 |
| 2024 | 7 | 7.05 |
| 2023 | 16 | 6.79 |
| 2022 | 12 | 6.18 |
| 2021 | 29 | 7.37 |
| 2020 | 20 | 5.64 |
| 2019 | 25 | 6.21 |
| 2018 | 31 | 5.86 |
It may take a day or so for new Jenkins vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Jenkins Security Vulnerabilities
Unrestricted Redirect in Jenkins Microsoft Entra ID Plugin Enables Phishing
CVE-2026-42525
4.3 - Medium
- April 29, 2026
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
Open Redirect
Stored XSS in Jenkins HTMLPub Plugin via Unescaped Job Name/URL
CVE-2026-42524
8 - High
- April 29, 2026
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
XSS
Jenkins GitHub Plugin XSS via URL Processing in 1.46.0 and earlier
CVE-2026-42523
9 - Critical
- April 29, 2026
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
XSS
Missing Permission Check in Jenkins GitHub Branch Source Plugin (CVE-2026-42522)
CVE-2026-42522
4.3 - Medium
- April 29, 2026
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.
AuthZ
Jenkins Matrix Auth Strategy Plugin arbitrary cls inst (CVE-2026-42521)
CVE-2026-42521
6.5 - Medium
- April 29, 2026
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Marshaling, Unmarshaling
Jenkins Credentials Binding Plugin filename sanitization flaw leads to RCE
CVE-2026-42520
7.5 - High
- April 29, 2026
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
Directory traversal
Jenkins Script Security Plugin: Missing Auth Check Enables Classpath Enumeration
CVE-2026-42519
4.3 - Medium
- April 29, 2026
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
AuthZ
LoadNinja Plugin 2.1 API Key Disclosure in Job Config
CVE-2026-33004
4.3 - Medium
- March 18, 2026
Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Information Disclosure
Jenkins LoadNinja Plugin <=2.1 API keys stored unencrypted
CVE-2026-33003
4.3 - Medium
- March 18, 2026
Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Cleartext Storage of Sensitive Information
Jenkins CLI WebSocket DNS Rebinding 2.421-2.554 & LTS 2.426-2.541
CVE-2026-33002
7.5 - High
- March 18, 2026
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Reliance on Reverse DNS Resolution for a Security-Critical Action
Jenkins <=2.554: Symlink Exploit in tar Extraction
CVE-2026-33001
8.8 - High
- March 18, 2026
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
insecure temporary file
Info Disclosure via Unchecked Run Parameter in Jenkins 2.550
CVE-2026-27100
4.3 - Medium
- February 18, 2026
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Information Disclosure
Jenkins 2.483-2.550 Stored XSS via Offline Cause
CVE-2026-27099
8 - High
- February 18, 2026
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
XSS
Jenkins Redpen - Pipeline to Jira: Path Validation Flaw <1.054, File Read
CVE-2025-67643
4.3 - Medium
- December 10, 2025
Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
Directory traversal
Jenkins Vault Plugin CVE-2025-67642: Context Miss for Vault Cred Leak
CVE-2025-67642
4.3 - Medium
- December 10, 2025
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.
Improper Ownership Management
Jenkins Coverage Plugin XSS via REST API ID unvalidated (before 2.3054)
CVE-2025-67641
8 - High
- December 10, 2025
Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.
XSS
cmd injection via unescaped workspace path in Jenkins Git Client Plugin pre-6.4
CVE-2025-67640
5 - Medium
- December 10, 2025
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
Shell injection
Jenkins CSRF in 2.540 & LTS 2.528.2 (CVE202567639)
CVE-2025-67639
3.5 - Low
- December 10, 2025
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.
Session Riding
Jenkins 2.540+ Build Auth Token Leak via Job Config Form
CVE-2025-67638
4.3 - Medium
- December 10, 2025
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Cleartext Storage of Sensitive Information
Jenkins <=2.540: build auth tokens plaintext in config.xml (Item/Ext Read)
CVE-2025-67637
4.3 - Medium
- December 10, 2025
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Cleartext Storage of Sensitive Information
Jenkins <2.540: View/Read Users Leaking Encrypted Passwords
CVE-2025-67636
4.3 - Medium
- December 10, 2025
A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values in views.
AuthZ
Jenkins CLI HTTP DDOS CVE-2025-67635
CVE-2025-67635
7.5 - High
- December 10, 2025
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
Improper Resource Shutdown or Release
Jenkins Publish-to-Bitbucket Plugin <0.4 RCE via Missing Permission Check
CVE-2025-64150
5.4 - Medium
- October 29, 2025
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
AuthZ
CSRF in Jenkins Publish_to_Bitbucket Plugin 0.4 Captures Credentials
CVE-2025-64149
5.4 - Medium
- October 29, 2025
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Session Riding
Jenkins Publish to Bitbucket Plugin 0.4 enum creds IDs via absent perm check
CVE-2025-64148
4.3 - Medium
- October 29, 2025
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
AuthZ
Jenkins Curseforge Publisher 1.0 exfiltrates unencrypted API Keys in config.xml
CVE-2025-64146
4.3 - Medium
- October 29, 2025
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Missing Encryption of Sensitive Data
Jenkins Curseforge Publisher Plugin 1.0 API Key Disclosure
CVE-2025-64147
4.3 - Medium
- October 29, 2025
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Missing Encryption of Sensitive Data
Jenkins BBA Plugin 1.0 API Tokens Unmasked in Job Config Form
CVE-2025-64145
4.3 - Medium
- October 29, 2025
Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Missing Encryption of Sensitive Data
Jenkins ByteGuard Build Actions Plugin 1.0 API token disclosure via config.xml
CVE-2025-64144
4.3 - Medium
- October 29, 2025
Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Missing Encryption of Sensitive Data
Unencrypted Auth Tokens Stored in Jenkins OpenShift Pipeline Plugin 1.0.57
CVE-2025-64143
4.3 - Medium
- October 29, 2025
Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system.
Missing Encryption of Sensitive Data
Privilege Escalation: Jenkins Nexus Task Runner Plugin <0.9.3 missing permission check
CVE-2025-64142
4.3 - Medium
- October 29, 2025
A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
AuthZ
Jenkins Azure CLI Plugin v0.9: Arbitrary Shell Cmd Exec
CVE-2025-64140
8.8 - High
- October 29, 2025
Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.
Shell injection
CSRF in Jenkins Nexus Task Runner Plugin <=0.9.2 Allows Remote URL Connect
CVE-2025-64141
4.3 - Medium
- October 29, 2025
A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Session Riding
Missing Permission Check in Jenkins Start Windocks Containers Plugin <=1.4
CVE-2025-64139
4.3 - Medium
- October 29, 2025
A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
AuthZ
Jenkins Start Windocks Containers Plugin CSRF before 1.4
CVE-2025-64138
4.3 - Medium
- October 29, 2025
A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.
Session Riding
Jenkins Themis Plugin <=1.4.1 RCE via Missing Permission Check
CVE-2025-64137
4.3 - Medium
- October 29, 2025
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
AuthZ
Jenkins Themis Plugin 1.4.1 CSRF allows remote HTTP server connectivity
CVE-2025-64136
4.3 - Medium
- October 29, 2025
A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.
Session Riding
Jenkins JDepend Plugin up to 1.3.1 XXE via outdated JDepend Maven Plugin
CVE-2025-64134
7.1 - High
- October 29, 2025
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
XXE
Jenkins Eggplant Runner Plug <=0.0.1.301 jdk.http.auth.tunneling.disabledSchemes
CVE-2025-64135
5.9 - Medium
- October 29, 2025
Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime.
Insecure Default Initialization of Resource
CSRF in Jenkins Extensible Choice Parameter Plugin Enables Groovy Execution
CVE-2025-64133
5.4 - Medium
- October 29, 2025
A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.
Session Riding
Jenkins SAML Plugin <4.583 Replay Attack via Missing Replay Cache
CVE-2025-64131
7.5 - High
- October 29, 2025
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.
Authentication Bypass by Capture-replay
Jenkins MCP Server Plugin 0.84 Improper Permission Checks
CVE-2025-64132
5.4 - Medium
- October 29, 2025
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.
AuthZ
Jenkins 2.527/LTS 2.516.2: Log Injection via Unrestricted Char in Log Msg
CVE-2025-59476
5.3 - Medium
- September 17, 2025
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Improper Output Neutralization for Logs
Jenkins 2.527 & LTS 2.516.2 Authenticated-User Profile Dropdown Bypass
CVE-2025-59475
4.3 - Medium
- September 17, 2025
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).
AuthZ
Jenkins <=2.527 LTS: Sidepanel Exec Widget Auth Bypass (CVE-2025-59474)
CVE-2025-59474
5.3 - Medium
- September 17, 2025
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.
AuthZ
Jenkins OpenTelemetry Plugin: Missing Permission Check (3.1543) Credential Exposure
CVE-2025-58460
4.2 - Medium
- September 03, 2025
A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
AuthZ
Jenkins global-build-stats Plugin REST API bypass allows ID enumeration
CVE-2025-58459
4.3 - Medium
- September 03, 2025
Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
Authorization
Jenkins Git Client Plugin 6.3.2 LFI via amazons3 URL Validation (Read)
CVE-2025-58458
4.3 - Medium
- September 03, 2025
In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Insertion of Sensitive Information into Externally-Accessible File or Directory
Jenkins Apica Loadtest Plugin <=1.10 Token Leak via config.xml
CVE-2025-53664
6.5 - Medium
- July 09, 2025
Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Unprotected Storage of Credentials
Jenkins Aqua Scanner Plug <3.2.8: Unencrypted Token Storage Leaks Data
CVE-2025-53653
4.3 - Medium
- July 09, 2025
Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Missing Encryption of Sensitive Data
