CVE-2019-10348: Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they...

Security readout for executives and security teams

CVE-2019-10348 is a Jenkins Gogs Plugin issue where configured credentials were saved in plaintext inside job config.xml files on the Jenkins master. Anyone with Jenkins Extended Read permission, or filesystem access to the master, could view those secrets. The main business risk is credential disclosure, not direct remote code execution from the described issue. Exposure is most likely in Jenkins environments using Gogs Plugin 1.0.14 or earlier with credentials configured in jobs. Risk increases where many users have Extended Read permission, backups include job config.xml files, or Jenkins master filesystem access is broadly available. Treat this as a credential exposure issue requiring timely remediation, especially if Jenkins has broad read access or sensitive Gogs credentials. It is not documented here as actively exploited, but plaintext secrets can create downstream compromise risk if copied or reused. Mitigation focus: Check Jenkins vendor guidance for the fixed plugin version and upgrade path.; Restrict Jenkins Extended Read permission to users with a clear operational need.; Restrict filesystem and backup access to Jenkins master job config.xml data..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.