CVE-2019-10366: Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on t...

Security readout for executives and security teams

This flaw could expose Skytap cloud credentials stored by Jenkins jobs. In affected plugin versions, credentials were saved unencrypted in job configuration files, so insiders or compromised Jenkins accounts with Extended Read permission could view them. Exposure is likely limited to Jenkins environments using Skytap Cloud CI Plugin 2.06 or earlier. Risk increases where Extended Read is broadly assigned or Jenkins controller file-system access is shared. Prioritize as a credential exposure issue, especially if Skytap credentials can affect production or customer environments. Treat broadly shared Jenkins read access as a business risk. Mitigation focus: Inventory Jenkins instances for Skytap Cloud CI Plugin 2.06 or earlier.; Review Jenkins advisory and vendor guidance for fixed versions or replacement guidance.; Restrict Extended Read permission to trusted administrators only..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.