CVE-2019-1003056: Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins mas...

Security readout for executives and security teams

This issue means Jenkins job configuration files could expose WebSphere deployment credentials in readable text. Anyone with Jenkins Extended Read permission, or access to the Jenkins master filesystem, may be able to view those secrets. The main business risk is credential compromise leading to unauthorized deployment or access to connected WebSphere environments. Exposure is most likely in Jenkins controllers that installed WebSphere Deployer Plugin and configured jobs with WebSphere credentials before or around April 2019. Risk depends on who has Extended Read permission or filesystem access to the Jenkins master. Treat this as a secrets exposure issue. It is not marked as actively exploited, but stored deployment credentials can create meaningful downstream risk if Jenkins permissions or server access are broad. Mitigation focus: Inventory Jenkins instances using WebSphere Deployer Plugin.; Restrict Extended Read permission to users with a clear operational need.; Limit Jenkins master filesystem access to trusted administrators only..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.