CVE-2019-1003069: Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the...

Security readout for executives and security teams

This flaw exposed Aqua Security Scanner Plugin credentials because Jenkins stored them in plaintext on the Jenkins master. The main business risk is credential disclosure by anyone who can access that server filesystem, which could undermine scanning integrations or connected Aqua accounts. Exposure is most likely in Jenkins environments that installed the Aqua Security Scanner Plugin before or around April 2019 and stored Aqua credentials in its global configuration. Risk depends heavily on who has Jenkins master filesystem access. Treat this as a credential exposure issue rather than a broad internet-facing emergency. Prioritize affected Jenkins masters, credential rotation, and access review, especially where Jenkins administrators or build hosts have broad production reach. Mitigation focus: Inventory Jenkins instances for Aqua Security Scanner Plugin usage.; Check Jenkins advisory and plugin guidance for any fixed or retired version.; If no fixed version is available, remove or disable the plugin..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.